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PREFACE 


This  Note  presents  the  first  results  of  Rand's  three-year  study, 
begun  in  April  1981,  on  how  probabilistic  risk-assessment  studies  might 
be  used  effectively  in  the  licensing  of  nuclear  power  plants.  The  study 
has  two  objectives:  to  assess  criteria  proposed  for  dealing  with  the 
question,  "How  safe  is  safe  enough  for  the  nuclear  power  industry?  ;  and 
to  develop  mechanisms  by  which  the  Nuclear  Regulatory  Commission  can  use 
this  information  in  its  decisionmaking  and  licensing  processes.  The  Note 
reports  the  results  of  the  first  objective;  a  forthcoming  study  will 
outline  the  research  currently  under  way  in  support  of  the  second 
objective. 

This  study  is  supported  by  Oak  Ridge  National  Laboratory  Contract 


No.  9025. 
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SUMMARY 

This  Note  assesses  approximately  90  safety  criteria  and  goals  for 
the  nuclear  power  industry  that  have  been  proposed  over  the  past  ten 
years  in  the  U.S.  and  elsewhere.  These  criteria  generally  address  the 
safety  of  nuclear  power  plants  in  terms  of  either  reactor  system  safety, 
individual  or  societal  risks,  or  in  other  measurable  terms,  such  as  dol¬ 
lar  damage.  We  first  categorize  the  criteria  and  then  evaluate  each 
item  according  to  the  following  seven  performance  measures. 

o  How  comprehensive  is  the  criterion? 

o  Is  it  precise  and  unambiguous? 

o  How  does  it  treat  uncertain  data  and  methodology? 

o  Is  it  realistic  and  practicable? 

o  Is  it  defensible? 

o  Is  it  simple  and  clearly  understandable? 

o  Is  it  internally  consistent? 

In  our  analysis,  three  trends  emerge: 

1.  Little  consensus  exists  on  what  constitutes  a  universal  risk 
criterion  or  on  how  to  achieve  such  a  criterion.  Although  cri 
teria  proposed  by  different  individuals  often  differ  by  orders 
of  magnitude,  they  may  be  based  on  equally  plausible  justifica 
tions .  Conversely,  numerically  identical  criteria  might  be 
based  on  rather  diverse  justifications.  These  factors  under¬ 
score  the  highly  subjective  nature  of  the  criteria  selection 
process,  a  process  that  may  not  yield  one  single,  universally 
accepted  criterion. 
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2.  No  single  criterion  is  both  simple  to  understand  and  easy  to 
implement;  also,  a  mechanism  for  implementing  the  criterion  is 
generally  not  offered. 

3.  None  of  the  criteria  can  adequately  accommodate  uncertainty  in 
the  data.  Although  any  valid  criterion  must  place  a  bound  on 
uncertainty,  such  uncertainty  is  inherent  in  any  complex  system 
and  must  be  treated  systematically. 

This  document  arrives  at  a  hybrid  risk  criterion  made  up  of 
features  of  many  of  the  criteria  evaluated.  (Because  it  is  made  up  of 
features  of  criteria  already  proposed,  rather  than  incorporating  addi¬ 
tional  new  features,  the  hybrid  is  not  necessarily  an  optimal  cri¬ 
terion.)  This  criterion's  features  resemble  the  specifications  outlined 
for  each  of  the  performance  measures,  and  as  such  it  has  the  same 
shortcomings  as  those  measures.  With  regard  to  each  of  the  performance 
measures  listed  above,  the  hybrid  criterion  has  the  following  specific 
qualitative  features: 

o  Comprehensively  addresses  direct  and  indirect  risk  to  society 
(here  we  consider  primarily  mortalities).  Considering  the 
direct  risks,  the  criterion  would  be  concerned  with  both 
immediate  and  delayed  mortality  and  would  consider  not  only  the 
individual  exposed  to  an  average  level  of  risk,  but  also  to 
individuals  exposed  to  higher  levels.  This  hybrid  criterion 
might  also  be  concerned  with  secondary  risks  from  evacuation, 
accident  cleanup,  and  job  relocations. 
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o  Simply,  explicitly,  and  unambiguously  justifies  its  basis; 
identifies  and  defends  each  of  its  assumptions;  and  explains 
clearly  its  limitations.  (Uncertainty  in  both  methodology  and 
data  base  should  be  precisely  accounted  for  by  incorporating 
into  the  criterion  a  range  of  error  bands.) 
o  Practical,  workable  premise.  It  would  be  beneficial  if  such  a 
criterion  had  been  used  before. 

o  Defensible  rationale  that  uses  past  experience  either  within 
the  nuclear  industry  or  some  other  industry  with  accident 
scenarios  of  similar  potential,  and  one  that  specifies  each  of 
its  assumptions  clearly. 

With  a  95  percent  band  of  confidence  on  information,  quantita¬ 
tively,  this  hybrid  criterion  might  require  the  following.  The  proba¬ 
bility  of  core  melt  per  reactor  year  (R-Y)  should  fall  between  l.OE-3 
and  l.OE-4.  For  a  marginal  increase  in  an  individual  s  annual  mortality 
rate,  the  range  might  be  between  2.0E-5  and  l.OE-6  per  R-Y.  For  socie¬ 
tal  risk  measured  in  person-rems,  the  range  might  be  between  1000  and 
10,000  per  R-Y  through  about  the  year  2000.  At  that  time,  and  depending 
on  the  size  of  the  nuclear  power  industry,  that  range  would  have  to  be 
reevaluated. 

Below  we  provide  a  basis  for  our  selection  of  this  hybrid  according 
to  its  quantitative  value  and  qualitative  description.  The  basis  for 
our  quantitative  range  is  simple  and  highly  subjective.  We  consider 
those  criteria  that  we  judge  best,  group  them,  and  specify  the  range  in 
values  that  this  group  covers.  Outliers  are  discarded  if  the  range  is 
much  beyond  an  order  of  magnitude.  The  basis  for  our  qualitative 
criteria  is  far  more  complex  to  describe. 
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i  We  believe  that  all  components  of  a  risk,  including  direct  and 
indirect  risks  and  immediate  and  delayed  risks,  are  necessary 
for  any  decision  between  alternatives.  For  any  specific  alter¬ 
native,  the  sum  of  all  direct  and  all  indirect  risks  reflects 
its  total  risk.  Although  two  distinct  alternatives  may  have 
similar  direct  risks,  their  indirect  risks  might  be  unique  to  a 
particular  alternative. 

)  We  argue  for  a  very  small  or  modest  rate  for  discounting  near- 
term  risks  and  a  zero  or  near-zero  rate  beyond  a  couple  of  gen¬ 
erations.  We  think  that  risks  to  future  generations  are  as 
important  as  risks  to  the  present  generation.  Although  an 
individual  would  certainly  discount  (i.e.,  wish  to  postpone) 
future  risks,  society  as  a  whole  would  be  less  willing. 

o  We  argue  for  a  straightforward  criterion  because  the  more  con¬ 
ditional  the  criterion,  the  more  subject  it  would  be  to  ambigu¬ 
ous  interpretation. 

o  We  argue  for  a  proven  criterion,  since  those  that  have  been 
proven  or  time-tested  are  generally  more  appealing  than  those 
that  are  merely  deduced. 

o  We  endorse  a  criterion  that  avoids  risk  aversion  because  by 

properly  accounting  for  all  indirect  risks  of  nuclear  power  and 
by  selecting  a  rationale  discount  factor  for  future  risks, 
including  an  additional  risk-aversion  factor  is  double  count¬ 
ing. 
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I .  INTRODUCTION 


In  May  1979,  the  Advisory  Committee  on  Reactor  Safeguards  (ACRS) 
recommended  that  "consideration  be  given  by  the  NRC  (Nuclear  Regulatory 
Commission)  to  the  establishment  of  quantitative  safety  goals  for 
nuclear  power  reactors"  and  that  "Congress  should  be  asked  to  express 
its  views  on  the  suitability  of  such  goals  and  criteria  in  relation  to 
other  relevant  aspects  of  our  technological  society."  Many  groups, 
including  the  national  laboratories,  nuclear  reactor  vendors, 
architect-engineers,  universities,  private  research  organizations,  and 
public  interest  groups  have  responded  and  continue  to  respond  by  propos¬ 
ing  numerous  safety  criteria. 

This  Note  reports  the  results  of  the  first  part  of  Rand  s  two-part, 
three-year  research  effort  for  Oak  Ridge  National  Laboratory  (ORNL) . 

Part  1,  initiated  in  April  of  1981,  assesses  about  90  of  the  proposed 
safety  criteria,  specifically  delineating  each  of  the  criteria,  develop¬ 
ing  a  set  of  performance  measures,  and  evaluating  them.  Based  on  the 
evaluation,  it  identifies  findings  generic  to  each  of  the  proposed  cri¬ 
teria  and  specific  to  one  or  a  few  of  them.  By  integrating  the  superior 
features  of  each  of  these  criteria.  Part  1  arrives  at  a  hybrid  cri¬ 
terion. 

Here,  we  will  discuss  risk  in  terms  of  human  mortality.  Although 
dollar  considerations  will  be  presented,  we  do  not  intend  to  address  the 
problems  of  judging  lives  and  dollars  at  the  same  time.  Therefore,  we 
will  usually  discuss  criteria  in  terms  of  various  risk  levels  to  individ 
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uals  or  groups  (e.g. ,  society  as  a  whole),  and  our  evaluations  will  be 
made  in  similar  terms. 

HOW  SAFE  IS  SAFE  ENOUGH? 

If  we  consider  the  issue  of  safety  in  and  of  itself,  we  might 
answer  that  question  with  "as  safe  as  technologically  possible,"  or  "as 
safe  as  humanly  possible."  Some  individuals  might  even  argue  that  only 
"zero  risk"  is  safe  enough.  Yet  safety  must  be  paid  for  either  directly 
(in  dollars)  or  indirectly  (in  diverted  resources).  And  once  we  add 
this  issue  of  cost,  we  see  how  difficult  the  question  is  to  answer  in 
that  zero-risk  safety  carries  with  it  an  inestimable  price  tag. 

To  appreciate  the  complexity  of  the  question,  "How  safe  is  safe 
enough?",  consider  the  three-part  experiment  recently  conducted  by  a  Los 
Angeles  reporter.  To  test  the  breaking-point  of  the  two-liter  bottle 
used  by  a  soft  drink  manufacturer,  this  reporter  loaded  a  few  dozen 
bottles  in  the  back  of  a  station  wagon.  After  a  rough  ride  over 
potholes  and  around  sharp  curves  at  high  speeds,  each  bottle  emerged 
intact.  Thus,  they  met  some  nominal  level  of  safety.  Next,  the 
reporter  dropped  a  few  dozen  of  them  from  a  helicopter  hovering  100  feet 
above  an  asphalt  pavement.  Only  one  broke.  He  then  put  a  two-liter 
bottle  under  a  baby  elephant's  foot.  It  broke.  This  series  of  experi¬ 
ments  demonstrates  that  at  some  point  more  stringent  safety  criteria  may 
become  impractical. 

This  need  to  balance  safety  against  cost  has  in  some  sense  been 
around  for  as  long  as  technology  itself.  Early  civilizations  experi¬ 
enced  it  when  they  built  structures:  thicker  walls  offered  greater 
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safety,  thinner  walls  greater  economy.  We  see  it  every  day  when  we 
drive  our  cars.  We  trade  off  higher  speeds  and  presumably  greater  con¬ 
venience  for  reduced  driving  safety.  The  last  few  decades  have  focused 
this  issue  of  safety  versus  cost  in  very  specific  technologies,  such  as 
nuclear  power. 

The  first  formal  approach  to  balancing  an  acceptable  level  of 
safety  against  some  reasonable  cost  came  from  the  concept  of  the  Maximum 
Credible  Accident  (MCA) .  This  concept  distinguishes  between  accidents 
that  are  so  "sufficiently  credible" --whatever  that  means--that  they  must 
be  designed  against,  and  those  that  are  so  "sufficiently  incredible" 
that  the  cost  of  designing  against  them  is  not  justified.  This  distinc¬ 
tion  is  clearly  subjective.  Its  weaknesses  include  the  intuitive  basis 
for  its  classification  of  accidents  (Mitra  et  al.,  1981),  its  failure  to 
quantify  safety,  and  its  failure  to  recognize  that  although  "incredible" 
accidents  may  have  low  frequency,  they  may  pose  a  greater  risk  because 
of  their  proportionally  greater  consequences. 

In  an  attempt  to  improve  the  MCA  approach,  the  Design  Base  Accident 
(DBA)  approach  evolved.  This  approach  principally  identifies  low- 
frequency,  high-consequence  events  that  must  be  protected  against. 
Although  subjective  judgment  on  what  is  credible  and  what  is  incredible 
is  avoided,  subjectivity  and  intuition  still  prevail  in  the  identifica¬ 
tion  of  accidents  included  in  the  design  base.  This  approach  still 
lacks  a  systematic,  formal,  probabilistic  method  to  determine  the  fre¬ 
quencies  and  consequences  of  accidents.  Such  a  method  would  be  an 
improvement,  since  the  accidents  considered  would  be  based  on  numerical 
estimates  of  which  might  be  most  important  in  terms  of  human  life.  That 
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is,  given  an  adequate  data  base,  such  a  formal,  probabilistic  method 
could  help  reduce  the  subjectivity  that  remains  in  the  current  DBA 
approach. 

The  NRC's  present  statutory  mandate  in  licensing  nuclear  power 
plants  is  similarly  subjective.  It  issues  an  operating  license  based  on 
a  reasonable  assurance  that  the  authorized  activities  can  be  conducted 
without  endangering  the  health  and  safety  of  the  public.  The  NRC  has 
not  yet  quantified  terms  like  "adequate"  and  "reasonable"  on  the  basis 
of  accident  frequency  and  consequence. 

In  recognition  of  a  need  to  quantify  standards  of  safety,  the 
Advisory  Committee  on  Reactor  Safeguards  (ACRS)  recommended  in  May  1979 
that  quantitative  safety  goals  be  considered  in  the  licensing  and  opera¬ 
tion  of  nuclear  power  plants.  These  NRC  recommendations  stimulated  much 
activity.  The  NRC's  System  Reliability  Research  Branch  instituted  and 
supported  research  and  development  programs  to  apply  risk  analyses  more 
widely  and  to  evaluate  implications  of  numerical  risk  criteria. 

Numerous  other  groups  initiated  and  supported  such  studies  as  well. 
These  groups  include  the  public  utilities,  the  Electric  Power  Research 
Institute,  national  laboratories,  universities,  and  private  research 
foundations . 

Clearly,  there  are  advantages  and  disadvantages  to  having  various 
organizations  proposing  quantified  safety  criteria.  The  more  people 
think  about  the  problem,  the  more  good  ideas  and  points  of  view  are 
expressed.  Unfortunately,  many  of  those  ideas  and  points  of  view  are 
inconsistent.  Deciding  which  are  best  is  the  aim  of  the  present  study. 
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SCOPE  OF  THIS  STUDY 

Sections  II,  III,  and  IV  address  the  three  primary  tasks  of  Part  1 
of  the  study.  Section  II  presents  approximately  90  of  the  proposed  risk 
criteria,  categorizing  them  by  their  applicability  to  the  reactor  sys¬ 
tem,  the  risk  to  an  individual  at  the  site  boundary,  or  the  risk  to 
society  as  a  whole.  The  criteria  are  arranged  on  the  basis  of  who  pro¬ 
posed  them,  the  technical  factors  that  they  consider,  and  whether  they 
take  into  consideration  specific  subjective  and  economic  factors. 
Technical  factors  that  may  be  considered  include:  accident  probability, 
accident  consequence,  number  of  people  exposed  to  the  risk,  whether  some 
segment  of  this  population  is  more  vulnerable  than  another,  how  uncer¬ 
tainty  in  risk  data  is  handled,  and  so  on.  These  criteria  may  be 
expressed  in  both  quantitative  and  qualitative  terms. 

Section  III  identifies  a  set  of  performance  measures  for  evaluating 
each  of  the  criteria  identified  earlier.  These  performance  measures 
include:  1)  Does  the  criterion  consider  a  range  of  societal  risks? 

2)  How  easily  can  a  criterion  be  implemented?  3)  How  simply  can  it  be 
expressed?  4)  How  does  it  treat  uncertainty  in  data  and  methodology? 

5)  Is  its  interpretation  ambiguous  or  unique?  6)  Is  the  criterion 
internally  consistent?  7)  Is  it  defensible?  Recognizing  the  possible 
ambiguity  in  these  measures  and  in  the  manner  in  which  they  might  be 
applied.  Section  III  also  contains  an  evaluation  of  the  proposed  cri¬ 
teria.  It  identifies  two  sets  of  findings:  those  that  are  generic  to 
most  or  all  of  the  proposed  criteria  and  those  that  are  specific  to  one 


or  a  few. 
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We  divide  Section  IV  into  four  subsections.  First,  we  examine  the 
extent  to  which  an  optimal  criterion  could  be  defined.  Second,  we  qual 
itatively  describe  a  hybrid  criterion  made  up  of  the  best  features  of 
those  criteria  that  we  have  already  evaluated.  Third,  we  offer  a  quan¬ 
titative  range.  And,  finally,  to  the  extent  we  can,  we  defend  this 
hybrid. 
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II.  THE  RISK  CRITERIA 


To  make  some  sense  of  the  various  definitions  of  risk  criteria,  we 
must  first  arrange  them  systematically,  identify  the  elements  that  those 
definitions  do  and  do  not  consider,  and  examine  the  similarities  and 
differences  between  the  criteria.  Rather  than  describe  each  proposed 
criterion  in  detail,  this  section  looks  at  the  range  of  responses. 

Before  discussing  the  criteria  themselves,  we  will  place  them  in 
the  context  of  current  approaches  to  reactor  safety .  We  have  already 
pointed  out  the  current  use  of  the  Design  Basis  Accident  approach,  even 
though  it  lacks  a  quantitative  basis.  We  then  mentioned  that  a  formal 
probabilistic  methodology,  known  as  Probabilistic  Risk  Assessment  (PRA) , 
would  be  a  useful  way  to  reduce  the  subjectivity  in  current  safety 
approaches.  In  fact,  any  effort  at  actually  calculating  a  numerical 
level  of  safety,  either  to  establish  a  safety  criterion,  or  to  assess 
current  levels  of  safety,  must  ultimately  depend  on  probabilistic  ana¬ 
lyses  of  these  sorts,  because  of  the  wide  levels  of  uncertainty  in 
available  data,  phenomenology,  and  methodologies. 

And  what  information  do  we  now  have  concerning  current  levels  of 
safety  in  nuclear  power  plants?  The  most  extensive  study  conducted  to 
date,  the  Reactor  Safety  Study  (WASH-1400),  used  a  probabilistic  frame¬ 
work  to  evaluate  the  safety  of  the  two  major  commercial  reactor  types  in 
the  United  States.  We  summarize  those  results  here  and  later  use  them 
as  reference  points  for  the  criteria. 

With  regard  to  the  probability  of  a  reactor  core  melting,  WASH- 1400 
derives  the  following  probability  estimates: 
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2.3E-6  for  the  hardware  contribution  to  core  melt. 

1.2E-6  for  the  human  contribution  to  core  melt. 

3.5E-6  for  the  total  contribution  to  core  melt. 

5.0E-5  for  the  "best  estimate"  value. 

4.0E-5  for  the  50  percent  confidence  level  (see  Bhattacharyya, 
1981). 

4.0E-4  for  the  95  percent  confidence  level  (see  Bhattacharyya, 
1981). 

Considering  individual  mortality  risk  at  a  reactor  site  boundary  as 
a  result  of  potential  accidents,  WASH- 1400  estimates 

2.0E-10  for  the  risk  of  early  fatality  per  reactor  year  per 
individual  exposed.  For  an  estimated  15  million  affected  indi¬ 
viduals  and  a  total  of  100  reactors  at  66  sites,  this  is  a 
societal  risk  of  3.0E-3  early  fatalities  per  year. 

Finally,  considering  the  risk  to  society  due  to  the  incidence  of 
latent  cancer  fatalities  resulting  from  nuclear  reactor  accidents,  we 
can  infer  a  rate  from  WASH- 1400,  of 

7.0E-4  latent  cancer  fatalities  per  reactor  year,  per  year,  or 
about  2.0E-3  total  latent  cancer  fatalities  per  reactor  year  of 
operation,  over  a  30-year  latency  period  following  exposure. 

As  we  discuss  the  criteria  themselves,  it  is  not  surprising  to  note 
that  many  are  expressed  in  terms  comparable  to  these,  since,  for  a  cri¬ 
terion  to  have  value,  it  must  be  measured  against  something.  Most  indi¬ 
viduals  or  organizations  offer  several  criteria,  and  the  range  in  their 
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proposals  generally  reflects  varying  confidence  bounds  in  the  PRA,  dif¬ 
ferent  estimates  in  number  of  reactors  on  line  in  a  future  year,  and 
different  classes  of  criteria  themselves. 

This  section  classifies  risk  criteria  according  to  level  of  safety 
involving 

o  Reactor  systems 

o  Individuals  at  or  adjacent  to  the  reactor  site 

o  Society  as  a  whole 

o  Qualitative  criteria  and  criteria  concerned  with  property  dam¬ 
age. 

REACTOR  SYSTEM  SAFETY 

All  proposed  criteria  dealing  with  system  safety  establish  safety 
bounds  based  on  core-melt  probabilities.  Core  melt  is  the  single  most 
important  accident,  since  it  is  the  accident  that  primarily  contributes 
to  radioactive  release.  As  such,  it  has  received  significant  attention 
from  those  who  suggest  risk  or  safety  criteria. 

Table  1  summarizes  30  criteria  (column  1),  proposed  by  11  investi¬ 
gators,  organizations,  or  individuals  (column  2)  for  the  frequency  of 
core  melt  (cm)  or  core  degradation  (cd)--a  less  serious  situation.  The 
bases  for  their  proposals  are  also  cited  (column  3).  Figure  1  displays 
the  information  presented  in  Table  1. 

The  proposed  criteria  range  widely,  from  5.0E-7  to  4.5E-3  core 
melts  per  reactor  year  (R-Y)  for  reactors  of  1  gigawatt  (GWe)  size. 
Thus,  these  criteria  range  both  above  and  below  the  WASH- 1400  reference 
points;  that  is,  safety  levels  for  currently  operating  reactors  appear 
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Table  1 


CRITERIA  FOR  THE  FREQUENCY  OF  CORE  MELT  PER  REACTOR  YEAR 


CORE  MELT  : 
PER  R-Y(a) : 

SOURCE  : 

BASIS(b)  : 

FREQUENCY  OF  AT 
LEAST  ONE  ACUTE 
FATALITY  PER  R-Y(c) 

l.OE-4  : 

ACRS  : 

(NUKEG-  ; 
0739)  : 

Hazard  state  d,  goal  level  for  large-: 
scale  fuel  melt.  : 

5  .  OE-4 

ACRS 

(NTREG- 

0739) 

Hazard  state  d,  upper  limit  for 
large-scale  fuel  melt. 

3.0E-4 

ACRS 

(NUREG- 

0739) 

Hazard  state  c,  goal  level  for 
significant  core  damage. 

1  .OE-3 

ACRS 

(N'UREG- 

0739) 

Hazard  state  c,  upper  limit  for 
significant  core  damage. 

l.OE-4  :(AIF,  : Atomic  -  Indus trial -Forum .  No  basis  : 

;  1981)  ;given.  : 

5  .  OE-7 

(Burns  , 
1979) 

5°o  chance  of  core  melt  during  life  : 
of  industry  (i.e.,  300  reactors  x  : 

300  years) .  : 

2.5E-5  : (Burns ,  :Alternate  criterion.  One  accident  in  : 

;  1979)  :40,000  reactor  years.  : 

l.OE-6 

(Bhatta- 
charyya , 
1981) 

Mean  frequency. 

5 .OE-3 

:  (Gries - 
;  meyer, 

:  1979) 

:  (Mitra, 

:  1981) 

:Hazard  state  c,  less  than  one  sig- 
:nif leant  core  damage  in  5  lifetimes 
:  (200  years) . 

1 .OE-3 

: (Gries  - 
:  meyer  , 

:  19  79) 

: (Mitra  , 

:  19  811 

:Hazard  state  d,  less  than  one  large- 
: scale  fuel  melt  in  25  lifetimes 
: ( 1000  years ) . 
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TABLE  1  (cont.) 


CORE  MELT  ; 
PER  R-Y(a); 

SOURCE  : 

BASIS(b)  : 

FREQUENCY  OF  AT 
LEAST  ONE  ACUTE 
FATALITY  PER  R-Y(c 

4.5E-3 

(Mitra,  :Unacceptability  limit  based  on  max- 

1981)  ; imum  likelihood  of  two  accidents 

: (Brown's  Ferry  and  Three  Mile  Island) 

; in  440  reactor  years  (Light  Water 
:Reactors  through  1979). 

9. lE-5 

5.5E-4  :(Mitra,  : 95%  confidence  level  based  on  above.:  l.lE-5 

:  1981)  :  : 

2.2E-3 

(Mitra, 

1981) 

$750  million  core  damage,  .32  mills/ 
KWH  differential  cost  between  nuclear 
and  coal,  1  GWe  plant  operating  at 

60%  present  capacity. 

1.7E-3  :(Mitra,  :Same  as  above,  except  assuming  : 

:  1981)  :$1  billion  damage.  : 

l.OE-4 

NRC 

(Inside 

NRC, 

i981a) 

Estimated  mean  probability  of  annual 
power  plant  accident  that  results  in 
a  large-scale  core  melt. 

3.0E-4 

0 ' Donne 1 
(Bhatta- 
charyya , 
1981) 

Mean  frequency. 

l.OE-3  :(Vesely,  lOperational  design  criterion.  : 

:  1980)  :  : 

l.OE-4 

<1.0E-3 

: (Vesely, 

;  1980) 

: Warning  range,  accounting  for  human 
:  error . 

l,0E-5  ; (Vesely,  :  System  and  component  failures.  : 

:  1980)  :  : 

l.OE-6 

: (Vesely , 

:  1980) 

: Warning  range,  not  accounting  for 
■.human  error. 

<1.0E-5 
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TABLE  1  (cont.) 

CORE  MELT 
PER  R-Y(a) 

SOURCE  :  BASIS(b) 

:  FREQUENCY  OF  AT 
:  LEAST  ONE  ACUTE 
:  FATALITY  PER  R-Y(c 

l.OE-5 

(Wall,  : Some  fraction  of  5. OE-4  used  in 

1979a)  ;WASH“1400. 

:  2. OE-7 

l.OE-4 

(Wall,  : Criterion  for  cladding  degradation 

1979b)  : 

5  .  OE-4 

(Zebro-  : One  core  melt  in  the  next  30  years 
ski , 1980) ; (moratorium  at  65  LWRs). 

:  4.0E-6 

3. 3E-4 

(Zebro-  : Chance  of  core  melt<l  in  3  in  next 
ski , 1980) : calendar  years,  using  low  estimate 
•.reactor  years  in  the  next  10  years 

10: 
of : 

3. lE-4 

(Zebro-  :Same,  using  medium  estimate  of 
ski, 1980) : reactor  years. 

2. 9E-4 

(Zebro-  :Same,  using  high  estimate  of 
ski , 1980) ; reactor  years. 

2.5E-4 

(Zebro-  : Chance  of  core  melt  under  66%  next 
ski, 1980) ; calendar  years,  using  low  estimate 
: reactor  years  in  next  20  years. 

20: 
of : 

2.3E-4 

(Zebro-  -.Same,  using  medium  estimate  of 
:  ski , 1980) : reactor  years. 

2.1E-4 

:  (Zebro-  :Sarae,  using  high  estimate  of  reactor  :  l.OE-5 
:  ski, 1980) :years .  : 

5  .OE-7 

;  (Zebro-  :5.0E-4  x  1/1000  probability  of  : 

:  ski, 1980) ; radiation  release  to  the  public  from  : 

:  :a  core  melt.  : 

note  ;  The  parenthetical  entries  in  the  SOURCE  column  correspond  to 


similar  entries  in  the  References, 

(a)  R-Y  is  defined  as  a  reactor  year.  The  reactor 
is  assumed  to  be  1  GWe  in  size. 

(b)  Hazard  state  c  assumes  >10%  of  noble  gas  inventory  leaking  into 
primary  coolant.  Hazard  state  d  assumes  >30%  of  the  oxide  fuel 
becoming  molten. 

(c)  Based  on  2%  probability  of  a  fatality,  given  a  core  melt. 

ACRS  =  Advisory  Committee  on  Reactor  Safeguards 

NRC  =  Nuclear  Regulatory  Commission 
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Frequency  of  core  melt  (and  degradation)  per  reactor  year,  Xgn  ( Xcd  ^ 

The  list  of  authors  of  quantitative  core  melt  criteria 
is  not  complete,  but  includes  experts  in  the  field 

1  Wash-1400  (Ref.  points)  7  Greismeyer 

2  Mitra  8  Vesely 

3  Zebroski  9  NRC 

4  Wall  10  Corkerton 

5  Burns  1 1  O'Donnel 

6  Atomic  Industrial  Forum  1 2  Advisory  CJommittee  on 

(Al  F )  Reactor  Safeguards 

Fig.  1 — Frequency  of  core  melt  and  core  degradation  ,  by  source 
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to  meet  some  criteria,  but  fail  others.  (Current  estimates  of  core-melt 
probability  range  between  4.0E-4  to  8.0E-4  core  melts  per  R-Y.)[l] 

The  bases  for  these  criteria  vary.  As  a  conservative  or  upper 
bound,  most  who  offer  proposals  use  the  probability  of  a  single  core 
melt  in  the  entire  reactor  industry  over  a  period  of  time;  some  use  a 
monetary  criterion  of  some  sort;  one  uses  as  a  basis  the  accidents  at 
Brown's  Ferry  and  Three  Mile  Island;  and  some  use  no  apparent  basis 
whatsoever.  A  few  use  a  high,  moderate,  and  low  set  of  estimates  that 
span  up  to  three  orders  of  magnitude. 

As  discussed  in  Levine  (1981) ,  three  or  four  of  the  proposals  exam¬ 
ine  reactors  on  a  case-by-case  basis.  These  proposals  are  by  the 
Advisory  Committee  on  Reactor  Safeguards  (ACRS)  or  (NUREG-0739)  in  our 
References;  UKAEA  in  Kinchin  (1979),  and  The  United  Kingdom  Central 
Electricity  Generating  Board  in  Corkerton  (Bhattacharyya,  1981).  The 
proposal  by  Joksimovic  (1980)  may  also  be  applicable  in  this  way. 

The  ACRS  proposal  makes  specific  reference  to  the  use  of  its  com¬ 
ponent  decision  rules  in  conjunction  with  plant-specific  PRAs  as  a 
licensing  tool  for  new  reactors.  The  decision  rules  proposed  cover  more 
potential  safety-related  aspects  of  risk  than  any  other  proposals,  and 
are  more  stringent  than  current  rules . 

Both  British  proposals  are  primarily  concerned  with  supporting 
specific  plant-licensing  decisions.  As  Levine  (1981)  notes,  because  of 

[1]  Noting  the  overlap  between  core-melt  criteria  and  estimates  of 
core-melt  probability,  we  see  that  some  criteria  would  indicate  that  the 
current  generation  of  reactors  is  unsafe.  Our  interpretation  is  dif¬ 
ferent;  we  argue  that  those  reactors  that  might  not  meet  the  standard 
should  be  cost  effectively  redesigned  to  meet  this  criterion.  (The  de¬ 
tails  of  such  an  assessment,  however,  are  beyond  the  scope  of  this 
study. ) 
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the  differences  in  licensing  practices  between  the  United  States  and  the 
United  Kingdom,  the  British  proposals  are  not  particularly  applicable  to 
our  needs.  Bhattacharyya' s  goal  is  being  used  as  the  basis  for  licens¬ 
ing  the  new  advanced  gas-cooled  reactors. 

Kinchin  does  not  explicitly  state  the  purpose  of  his  proposal. 

Levine  (1981),  however,  contends  that  Kinchin's  intention  would  be  to 
use  the  goal  on  a  plant -by-plant  basis.  Kinchin's  proposal  has  not  yet 
been  adopted  by  the  British  regulatory  authorities. 

Levine  (1981)  states  that  the  AIF  (1981)  proposal  is  aimed  at 
overall  regulatory  decisionmaking,  but  not  plant-specific  licensing 
decisionmaking  for  levels  of  overall  safety.  AIF  suggests  that  the 
direct  application  of  PRA  and  Safety  Goals  in  specific  pi ant -licensing 
process  decisions  is  premature  at  this  time. [2] 

Like  Kinchin,  Joksimovic  does  not  specifically  state  a  particular 
purpose  in  his  proposal.  But  Levine  (1981)  reports  that  the  intent  of 
the  Joksimovic  proposal  is  aimed  primarily  at  the  regulatory  process, 
and  not  at  licensing. 

Levine  contends  that  safety  proposals  should  not  be  used  at  this 
time  in  the  licensing  of  individual  reactors.  He  describes  how  specific 
PRA  studies  have  been  properly  used  by  the  NRC  in  making  sound  decisions 
on  reactor  safety.  He  further  notes  that  to  make  full  use  of  such  risk 
assessments  it  is  necessary  to  establish  quantitative  safety  levels. 

Levine  notes  that  the  basis  of  Starr  and  Whipple's  proposal  (to  be 
discussed  later)  is  quite  different  from  his  own.  Starr  and  Whipple 

[2]  Although  licensing  is  part  of  the  regulatory  process,  we  dis¬ 
tinguish  here  between  plant-specific  licensing  considerations  and  gener¬ 
ic  regulatory  considerations. 
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observe  that  because  of  the  costliness  of  major  nuclear  plant  accidents, 
steps  must  be  taken  to  ensure  against  them.  To  compensate  for  the  in¬ 
equitable  risk  to  those  who  live  close  to  a  reactor  site,  they  propose  a 
utility  rate  credit. 

For  a  set  of  core-melt  probabilities,  Mitra  et  al.  (1981)  set  an 
acceptability  criterion  based  on  estimates  of  at  least  one  fatality 
induced  by  core  melt  per  R-Y.  Based  on  the  simplistic  assumption  (from 
WASH- 1400)  that  there  is  a  2  percent  probability  of  a  fatality  given  a 
core  melt,  column  3  in  Table  2  displays  Mitra's  criterion  for  at  least 
one  fatality  per  reactor  year.  This  number  varies  between  roughly  one 
in  ten  thousand  to  two  in  a  hundred  million- -a  range  so  great  that  its 
value  might  be  insignificant. 

RISK  TO  INDIVIDUALS  AT  OR  ADJACENT  TO  THE  REACTOR  SITE 

The  risk  to  individuals  at  or  adjacent  to  the  reactor  site  is 
defined  as  the  marginal  increase  in  annual  mortality  risk  per  individual 
exposed.  Units  are  most  often  expressed  as  mortalities  per  R-Y;  one 
person  offers  a  criterion  in  units  of  millirems  (mrem) . 

Table  2  and  Figure  2  demonstrate  that  the  proposed  criteria  for 
individual  mortality  risk  per  R-Y  range  between  l.OE-8  and  l.OE-4  (Table 
2,  column  1),  all  well  above  the  WASH-1400  estimate.  The  bases  for 
these  proposed  criteria  vary  (Table  2,  column  3).  A  total  of  22  indi¬ 
vidual  risk  criteria  are  offered  by  15  individuals  and  organizations. 
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Table  2 

CRITERIA  FOR  INDIVIDUAL  MORTALITY  RISK  AT  REACTOR  SITE 


RISK  PER 

R-Y  or  S-Y(a) 

SOURCE 

BASIS 

5.0E-6 
per  S-Y 

ACRS 

(NUREG-0739) 

Delayed  fatality  goal  level  for  maximally 
exposed  individual. 

2.5E-5 
per  S-Y 

ACRS 

(NUREG-0739) 

Delayed  fatality  upper  limit  for  maximally 
exposed  individual. 

l.OE-6 
per  S-Y 

ACRS 

(NUREG-0739) 

Early  fatality  goal  level  for  maximally 
exposed  individual. 

5.0E-6 
per  S-Y 

ACRS 

(NUREG-0739) 

Early  fatality  upper  limit  for  maximally 
exposed  individual. 

l.OE-5 

(Adams  & 
Stone , 

1967) 

An  incremental  increase  in  an  individual's  chance 
of  death  per  year  that  is  smaller  than  the 
demographic  variation.  In  the  United  Kingdom, 
that  chance  of  death  per  year  is  inappreciable  and 
acceptable . 

l.OE-5 
per  S-Y 

AIF 

(Inside  NRC, 
1980a) 

Early  and  latent  fatality  risk  to  maximally 
exposed  average  individual,  goal  level. 

1.2E-6 

(Atchison , 
1979) 

Canadian  safety  requirements  for  licensing  of  CANDU 
nuclear  power  plants:  Average  annual  dose  of 

9  mrem/yr  x  130  delayed  deaths  -  l.OE-6  person  rem. 

l.OE-5 

(Bowen, 1975) 

Early  and  delayed  fatalities.  Aim  is  to  have  a 
small  chance  (i.e.,  1%)  of  a  large 
catastrophe  in  a  lifetime. 

l.OE-7 

(Burns , 1979) 

Delayed  death  to  300  million  people,  and  30  total 
deaths  per  year. 

l.OE-4 

ICRP 

(Inside  NRC, 
1980b) 

Acceptable  risk  for  radiation  worker. 

RISK  PER 

R-Y  or  S-Y(a) 

SOURCE 

BASIS 

l.OE-5 

ICRP 

(Inside  NRC, 
1980b) 

Acceptable  risk  for  maximally  exposed  individual. 
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Table  2  (Cont . ) 


l.OE-6 

Inter-Organ- ; 
izational  : 
Working  : 
Group  : 

Likelihood  of  a  lethal  dose  (200-400  whole  body 
rem)  to  any  nearby  resident. 

l.OE-A 

(Joksimovic, : 
1980) 

Early  and  latent  fatality. 

l.OE-6 

(Kinchin,  : 

1979)  ; 

Early  fatality.  International  Commission  on 
Radiological  Protection  (ICRP)  states  that  l.OE-6 
to  l.OE-5  should  be  acceptable.  Webb  and  McLean 
state  that  l.OE-6  does  not  play  a  part  in 
individual  decisionmaking. 

3.0E-5 

(Kinchin,  : 

1979)  : 

Delayed  fatality.  Based  on  factor  of  30  disparity. 

l.OE-6 

(Mitra,1981) 

One%  of  lowest  death  risk  (10-year-old 

Caucasian  female)  of  l.OE-4. 

l.OE-5 

(Mitra,1981) 

95%  confidence  level  of  above. 

5.0E-6  to 
l.OE-5 

NRC 

(Inside  NRC, 
1981a) 

Mean  probability  of  early  and  delayed  fatality  from 
an  accident  to  an  individual  living  or  working 
in  the  vicinity  of  the  plant  site  throughout  their 
lives . 

l.OE-8 

:  (Starr, 

:  1981) 

Early  and  latent  fatality  goal  level. 

l.OE-4 

: (Starr, 

:  1981) 

Early  and  latent  fatality  upper  limit. 

l.OE-8 

; (Wall, 

:  1979a) 

:  Early  death.  No  basis  given. 

2.0E-5 

: (Maxey , 

;  1982) 

;  Early  plus  delayed  fatality;  derivable  from  a 
:  dose  criterion. 

NOTE;  The  parenthetical  entries  in  the  SOURCE  column  correspond  to 
similar  entries  in  the  References. 


(a)  All  criteria  are  given  in  units  of  R-Y  (reactor  years)  unless 
specified  as  S-Y  (site  years) . 

ACRS  =  Advisory  Committee  on  Reactor  Safeguards 
AIF  =  Atomic  Industrial  Forum 
ICRP  =  International  Committee  on  Radiological  Protection 
NRC  =  Nuclear  Regulatory  Commission 


Source 
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Source; 


Individual  mortality  risk  per  R-y  or  (S-y) 


1  Wash -1400  (reference  point)  9  Inter-Organizational  Working  Group 


2  Advisory  Committee  on  1  0  Joksimovic 

Reactor  Safeguards  (ACRS)  1 1  Kinchin 

3  Adams  and  Stone  1  2  Mitra 

4  AIF  13  nRC 


5  Atchison 


14  Starr 


6  Bowen 


1  5  Wall 


7  Burns 


1  6  Maxey 


8  ICRP 


Fig.  2--Criteria  for  Individual  Mortality  Risk  at  Reactor 
Site  Boundary,  by  Source 
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Two  types  of  individual  mortality  criteria  are  offered:  those  con¬ 
cerning  immediate  or  early  mortality  and  those  concerning  only  delayed 
mortality.  For  immediate  or  early  deaths  among  the  general  population, 
the  proposed  criteria  range  from  l.OE-8  (Wall,  1979a)  to  l.OE-4  (Joksi- 
movic,  1980),  all  less  stringent  than  the  2.0E-10  which  we  infer  from 
WASH- 1400. 

Among  the  criteria  proposed  for  immediate  or  early  death,  most 
individuals  report  a  mean  value,  and  some  bound  their  proposals  by  also 
reporting  a  confidence  interval.  For  example,  Mitra  et  al .  (1981) 
report  a  criterion  with  a  mean  value  of  l.OE-6  mortality  rate  per  R-Y, 
derived  by  taking  1  percent  of  the  gross  mortality  rate  of  a  10-year-old 
Caucasian  female  (the  lowest  of  any  human  mortality  range) .  This  mean 
value  assumes  limited  information  regarding  the  exposed  risk.  For 
situations  involving  a  95  percent  confidence  in  information,  Mitra  et 
al.  propose  l.OE-5.  The  Advisory  Committee  on  Reactor  Safeguards  (ACRS) 
also  tentatively  proposes  two  criteria:  l.OE-6  as  the  proposed  goal  and 
5.0E-6  as  the  proposed  upper  limit,  both  for  the  maximally  exposed  indi¬ 
vidual  (NUREG-0739) . 

Although  some  people  distinguish  between  an  early  and  a  delayed 
death  criterion,  others  do  not.  Starr  (1981)  proposes  a  criterion  of 
l.OE-8  for  early  and  delayed  death  as  a  goal  and  l.OE-4  as  an  upper 
limit.  Here  we  should  note  that  the  difference  between  the  ACRS  goal 
level  and  upper  limit  is  only  a  factor  of  50,  whereas  the  corresponding 
difference  between  the  Starr  proposals  is  a  factor  of  10,000.  Although 
we  have  no  rationale  for  judging  which  of  these  two  factors  makes  more 
sense,  we  believe  that  a  factor  as  large  as  10,000  might  mask  any  bene- 
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fits  achieved  from  having  a  quantitative  criterion.  Joksimovic  also 
proposes  identical  numbers  for  early  and  delayed  deaths,  that  is,  l.OE-4. 

Kinchin  (1979)  and  the  WASH-1400  reference  results  distinguish 
between  early  and  delayed  mortality  (i.e.,  they  discount  delayed 
deaths).  For  the  delayed  mortality  rate.  Kinchin  (1979)  proposes  a  fac¬ 
tor  of  30  less  stringent  than  that  for  immediate  mortality.  Griesmeyer 
et  al.  (1979)  suggest  two  other  factors.  They  recommend  a  factor  of  5 
for  individual  risk,  and  based  on  other  information  they  supply,  we  can 
infer  a  ratio  of  about  7  or  8  for  societal  risk.  In  the  latter  case, 
Griesmeyer  et  al.  apply  a  risk  aversion  factor  for  early  fatalities  for 
the  societal  criterion,  thus  increasing  the  "future  discounting  of 
latent  fatalities . [3] 

Although  we  are  not  sure  of  the  precise  logic  used  by  Kinchin 
(1979)  and  by  Griesmeyer  et  al.  (1979),  we  believe  that  the  potential 
effect  of  discounting  future  risks  is  too  huge  to  be  treated  in  a  casual 
fashion.  Such  a  discounting  concept  must  be  thought  out  carefully  and 
must  distinguish  between  societal  and  individual  discounting  of  risk. 

(We  shall  treat  the  issue  of  discounting  in  a  future  document.) 

One  of  the  more  refreshing  criteria  offered  comes  from  Maxey 
(1952).  This  very  straightforward  proposal  suggests  that  an  acceptable 


[3]  We  detect  a  logical  error  with  the  argument  of  Griesmeyer  et 
al.  Setting  aside  their  rather  large  values  for  discounting  future 
risks,  we  might  expect  that  individual  risk  rather  than  societal  risk 
would  have  a  higher  discount  factor.  We  contend  that  the  individual 
would  have  a  greater  incentive  than  society  as  a  whole  to  postpone  his 
or  her  risk.  As  an  example,  all  other  things  equal,  an  individual  would 
strongly  wish  to  postpone  his  or  her  mortality  from  age  50  to  age  80. 

On  the  other  hand,  an  excess  societal  mortality  rate  of  1  percent  is 
equally  serious  if  it  happens  today  or  in  30  years. 
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criterion  would  be  one  that  is  roughly  equal  to  the  variance  across  the 
country  in  background  radiation  dose.  If  we  assume  that  this  variance 
is  200  milli-rems  (a  rem  is  a  unit  of  biologically  assessed  dosage  of 
radiation)  (actually,  the  variance  is  larger  if  we  take  the  most  extreme 
low  dose  and  the  most  extreme  high  dose),  and  using  a  standard  dose- 
response  relationship  by  assuming  one  excess  fatality  per  10,000 
person- rems,  we  find  that  Maxey's  criterion  reduces  to  2.0E-5  mortality 
risk  per  R-Y. 

For  delayed  mortality  among  occupational  workers,  the  proposed  cri¬ 
teria  are  less  conservative;  only  the  International  Committee  on  Radio¬ 
logical  Protection  (ICRP)  (Inside  NRC,  1980b)  proposes  l.OE-4  per  reac¬ 
tor  year. 

Table  2  summarizes  a  variety  of  other  proposals  for  individual  mor¬ 
tality  risk  per  R-Y. 

SOCIETAL  RISK 

Many  people  proposed  criteria  specifying  acceptable  levels  of 
societal  risk.  Here  we  define  societal  risk  as  the  sum  total  of  all  the 
risks  to  all  affected  individuals,  and  calculate  it  as  the  product  of 
the  total  number  of  people  exposed  and  the  radiation  dose  per  person 
integrated  over  time  of  exposure.  Table  3  and  Figure  3  express  this 
risk  in  terms  of  person-rems  per  R-Y,  and  in  cases  of  (immediate)  thy¬ 
roid  cancers  or  cases  of  latent  thyroid  fatalities  (LTF)  per  l.OE+10 
kilowatt  hours. [4]  Based  on  individual  risk  criteria  and  assuming  a  set 
of  standard  populations  around  a  reactor  site,  societal  risk  criteria  in 


[4]  1.000  GWe  R-Y  =  0.874E+10  kilowatt  hours. 
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Table  3 

CRITERIA  FOR  SOCIETAL  RISK 


RISK  PER  R-Y  : 

(FATALITY  PER 
l.OE+10  KWH)  : 

SOURCE  ; 

BASIS 

(2)  : 

ACRS  : 

(NUREG-0739)  : 

Delayed  fatality  goal  level. 

(10)  : 

ACRS  : 

(NUREG-0739)  : 

Delayed  fatality  upper  nonacceptance 
limit . 

(0.4)  : 

ACRS 

(NUREG-0739) 

Early  fatality  goal  level 
(with  risk  aversion) . 

(2)  : 

ACRS 

(NUREG-0739) 

Early  fatality  upper  nonacceptance 
limit  (with  risk  aversion). 

(1.2) 

(AIF,  1981) 

Not  mentioned  if  delayed  o^ea^y 
fatality.  Since  delayed  death  is  the 
dominant  societal  risk,  public  fatality 
may  be  construed  as  latent  fatality. 

<.l  fatalities 
per  GWe  year 

AIF  : 

(Inside  NRC,  : 

1980a)  : 

3667  person-rems 

(Atchison, 1979) 

:  Canadian  Reactor  Siting  Guide. 

1.2E-2  Latent 
Cancer  Fatalities 
(LCF) 

:  (Atchison,  1979) 

;  1  Latent  Cancer  Fatality  (LCF)  per 
:  10,000  person-rems  during  30-year 
;  period. 

0.0018-0.0110 
thyroid  cancers 

;  (Atchison,  1979) 

:  0.5 -3.0  thyroid  cancers  per  thyroid  rem. 

0.00025-0.0015 
Latent  Thyroid 
Fatalities  (LTF) 

:  (Atchison, 1979) 

:  Mortality  rate  of  0.04  for  cTiildren 
:  under  10  (15%  of  population)  and  .15 
:  for  remainder. 

0.10  LCF 

: (Burns, 1979) 

:  l.OE-7  LCF  per  person,  300  reactor  years 

500  person-rems 

: (Burns, 1979) 

:  5000  person-rems  per  LCF,  300  million 
:  population,  300  reactors. 
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Table  3  (Cont.) 


RISK  PER  R-Y 
(FATALITY  PER 
l.OE+10  KWH) 

SOURCE 

BASIS 

750  person-rems 

(Burns, 1979) 

5000  person-rems  per  LCF,  300  million 
population,  200  reactors. 

1500  person-rems 

(Burns, 1979) 

5000  person-rems  per  LCF,  300  million 
population,  100  reactors. 

.01 

(Joksimovic, 

1980) 

Total  LCF  based  on  "no  identifiable 
public  injury"  for  an  accident  with 
a  probability  of  l.OE-4  per  R-Y. 

(With  risk  aversion  for  higher 
consequence  accidents.)  (Figure  4) 

Comprehens ive 
risk  curves 

(Kinchin, 1979) 

Site-specific  criterion.  Complementary 
cumulative  distribution  factor. 

Comprehens ive 
risk  curves 

(Levine , 1980) 

Interim  safety  goal.  1/10  the  level  of 
lowest  non-nuclear  risk  from  WASH- 1400 
(i.e.,  risk  of  death  for  persons  on 
ground  from  aircraft  crashes .  Year 
criterion. ) 

<2/GWe  year 

NRC 

(Inside  NRC, 
1981a) 

Statistically  estimated  mean  fatalities. 

500  person-rems 

(Wall, 1979a) 

:  Expected  accidental  population  dose. 

0.05  LCF 

:  (Wall,  1979a) 

:  Based  on  1  LCF  per  l.OE-4  person-rems. 

25,000  person- 
rems 

:  (Zebroski, 

:  1980) 

:  10%  probability  per  failure  of  popula- 
:  tion  receiving  this  dose. 

NOTE:  The  parenthetical  entries  in  the  SOURCE  column  correspond  to 

similar  entries  in  the  References. 

ACRS  =  Advisory  Committee  on  Reactor  Safeguards 

AIF  =  Atomic  Industrial  Forum 

NRC  =  Nuclear  Regulatory  Commission 


Source 


12 
11 
10 
9 
8 
7 
6 
5 
4 
3 
2 
1 
0 

Person  rems  Total  latent  cancer  fatalities  per  reactor  year  Fatality  per  GWe  year 

6  Joksimovic 

7  NRC 

8  Wall 

9  Zebroski 

Fig.  3 --Criteria  for  Societal  Risk,  by  Source,  per  Reactor  Year 


Source: 

1  Wash -1400  (reference) 

2  ACRS 

3  AIF 

4  Atchison 

5  Burns 


5x10“®  5x10-®  5x10-^  5x10-3  5xio-2 
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terms  of  deaths  per  reactor  year  can  also  be  inferred  from  Table  2. 

The  annual  person-rem  dose  proposals  vary  between  500  (Burns,  1979) 
and  25,000  (Zebroski,  1980)  and  are  based  on  a  variety  of  factors. 

Burns  considers  that  the  number  of  reactors  in  the  country  vary  between 
100  and  200.  Zebroski  bases  his  criterion  on  the  probability  of  a  10 
percent  chance  of  the  population  receiving  a  radiation  dose  following  an 
accident . 

Only  the  Canadians  propose  a  criterion  based  on  the  incident  rate 
of  thyroid  cancer  (Atchison,  1979).  They  propose  a  rate  of  between 
0.0018  and  0.0110  per  R-Y. 

A  variety  of  proposals  based  on  incident  rate  of  latent  cancer 
fatalities  (LCF)  is  reported.  The  Canadians  propose  an  LCF  of  0.012  per 
R-Y.  They  base  this  on  the  assumption  that  1  LCF  is  caused  per  10,000 
person-rems  of  exposure,  spread  over  a  30-year  period  of  latency  follow¬ 
ing  the  exposure.  Wall  (1979a)  and  Burns  (1979)  propose  LCFs  of  0.05 
and  0.1  per  R-Y,  respectively.  These  are  all  less  stringent  than  the 
WASH- 1400  results,  from  which  we  infer  an  estimate  of  about  0.002  total 
LCFs  per  year  of  operation. 

One  factor  that  can  be  applied  to  societal  risk  is  risk  aversion. 
This  factor  generally  represents  an  individual's  or  society  s  acceptance 
or  rejection  of  differing  risks  on  the  basis  of  such  factors  as  the 
nature  of  the  risk,  its  early  or  delayed  effect,  the  nature  of  its 
consequences,  and  so  on.  In  the  discussion  on  individual  risk,  risk 
aversion  factors  of  up  to  30  were  mentioned  in  weighting  delayed  risks 
less  importantly  than  immediate  risks.  Here,  we  also  mention  society  s 
aversion  to  high- consequence  risks.  That  is,  a  single,  large  event  with 
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a  potential  number  of  casualties  is  generally  considered  more  undesir¬ 
able  than  several  smaller  events  whose  total  probability  and  total 
casualties  are  the  same  as  those  for  the  single  large  event. 

Griesraeyer  et  al.  (1979)  and  the  ACRS  (NUREG-0739)  findings  present 
a  model  that  accentuates  the  undesirability  of  high-consequence  risks. 
Although  they  suggest  a  numerical  value  of  1.2  for  their  risk-aversion 
parameter  (1.0  would  imply  no  aversion  and  less  than  1.0,  a  preference), 
they  also  point  out  that  the  very  simplicity  of  this  model  negates  its 
usefulness  over  the  range  of  societal  attitudes  toward  various  levels  of 
consequences.  We  agree. 

The  explicit  recognition  of  this  numerical  factor  is  indicated  in 
Table  3  for  the  ACRS  criteria  (NUREG-0739).  Joksimovic  (1980)  uses  a 
similar  model  with  an  equivalent  factor  of  1.5.  Others  may  or  may  not 
have  factored  risk  aversion  into  their  choices  for  specific  numeric 
goals . 

In  our  review  of  the  risk-aversion  literature  (see  Salem  et  al., 
1980),  we  could  not  locate  a  consistent  set  of  factors  leading  to  a 
unique  numerical  value.  Choosing  a  single  number,  we  believe,  might 
bias  the  criterion.  We  find  this  factor  to  be  sensitive  to  the  size  of 
the  accident,  the  nature  of  the  accident,  and  the  subjectiveness  of  the 
interpret ation. 

QUALITATIVE  CRITERIA  AND  CRITERIA  BASED  ON  DOLLAR  DAMAGE 

Table  4  and  Fig.  4  present  both  qualitative  criteria  and  criteria 
that  assess  dollar  damage.  For  example,  the  Atomic  Industrial  forum 
(AIF,  1981)  proposes  that  the  incremental  cumulative  risk  due  to  nuclear 
power  plants  should  be  a  "small"  fraction  of  average  background  health 
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Table  4 


QUALITATIVE  CRITERIA  AND  CRITERIA  BASED  ON  DOLLAR  DAMAGE 


SOURCE 


(Maxey , 
1982) 


(AIF,1981) 


COMMENTS 


|s|i!s| 

|Y|N|Ol 

!s|d|c| 

iTllIll 

lElVlEl 

|Mll|Tl 

1  |D|A| 
i  lUlLl 
I  1A|  I 
I  ILI  I 


ACRS  I  Early  fatality  valued  at  $5  million  per  life  saved.  1 

(NUREG-  I  Delayed  fatality  valued  at  $1  million  per  life  saved.  | 

0739)  I  Property  damage  =  twice  economic  loss.  I 

(Adams  &  1  Incremental  increase  in  individual's  chance  for  death  | 

Stone,  I  per  year  less  than  demographic  variation  in  UK.  1 

1967)  I  Societal  criterion  not  useful  because  of  uncertainty  in  ] 

1  potential  number  of  casualties.  1 

I  Policy  did  not  consider  property  or  other  resource  | 

I  damage .  I 

(Maxey,  1  The  allowable  dose  should  equal  the  variance  in  dose  | 

1982)  I  likely  to  be  seen  across  the  country.  No  uncertainty  ] 

I  considerations  were  given.  I 

(AIF,1981)  1  No  individual  should  bear  an  inordinate  risk. 

I  The  incremental  cumulative  risk  should  be  a  small  frac- 
1  tion  of  average  background  incidence  of  health  hazards . 

I  Goal  should  promote  rational  allocation  of  resources 
I  to  reduce  public  risk  to  achieve  optimum  benefit  attain- 
)  able  for  the  cost.  $100/person-rera.  $1  million  per  life 
j  saved. 

AECC  1  Safety  responsibility  must  rest  with  the  licensee. 

(Nucleon-  |  Defense- in-depth  approach. 
ics , 1980c) I 

(Atchison,  1  Process  system  failure  =  lE-2  to  lE-4/yr.  Special  safety 
1979)  I  system  failure  =  lE-3.  Dual  failure  =  lE-5  to  lE-7/year. 


Eklund  I 
(Nucleon-  j 
ics , 1980c) 


system  failure  =  lE-3.  Dual  failure  —  lE-5  to  lE-7/year. |xl 
Not  enough  experience.  j^j 
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Table  4  (Cont . ) 


SOURCE  1 

COMMENTS 

s| 

Y| 

s| 

T| 

El 

M 

II 

Ni 

D| 

I| 

v| 

I| 

D| 

u| 

A| 

L| 

s|$ 

0| 

C| 

II 

E| 

T| 

Al 

L| 

1 

ICRP  1 
(Nucleon-  1 
ics , 1980b) 1 

Goal  is  to  see  risk  of  death  to  radiation  worker  less 
than  or  equal  to  that  of  safe  industry  worker. 

1  1 
xl  1 

1  i 

(Joksimo-  1 
vie, 1980)  1 

Figure  4 

1 

1  X 

1 

(Kaplan,  | 

1981)  1 

Only  infinite  safety  is  safe  enough. 

Benefits  are  not  considered. 

1 

X 

1 

x| 

Levenson  & 
Rahn 

Number  of  acute  fatalities  and  injuries  6  months  after 
accident . 

xl 

NRC 

(Inside 

NRC, 1981a) 

Presently  employs  system  lanavailability  (i.e.,  single 
failure  criterion)  in  licensing  process.  Limits  overall 
risk,  but  not  sufficient. 

"Members  of  the  public  should  be  provided  a  level  of 
protection  such  that  no  individual  bears  a  significant 
risk  to  life  and  health." 

"Societal  risk  associated  with  nuclear  power  plant  op¬ 
eration  should  be  as  small  as  can  be  reasonably  achieved 
and  should,  in  any  event,  be  consistent  with  the  risks 
of  competing  technologies  for  generating  electricity. 

X 

X 

1 

1 

1 

1 

1 

1 

1 

1  1 

x| 

OTA, 1981 

Four  approaches  to  standardization; 

1)  Universal  software  practices,  2)  rush  NRC's  program, 
3)  safety  block  concept  for  standardization  of  systems, 
and  4)  selection  of  single  design. 

X 

1 
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(Rowsome,  |  Short-term  goal:  chance  of  significant  accident  up  to 

1980)  I  .2  percent  in  time  between  completion  of  short-term  fix 

I  and  end  of  plant  life. 

(Slovic,  I  Risk  statistics  have  little  utility  as  guides  to  nuclear]  ] 
1980)  I  safety  policies.  Need  to  minimize  probability  of  small  |  | 

I  accidents.  Risks  perceived  as  unique,  uncontrollable,  |  [ 

1  unknown,  potentially  catastrophic,  and  dreaded.  I  | 

I  Greatest  cost  of  an  accident  is  public  relations  and  |  | 

1  effect  on  nuclear  future.  1  I 

(SRP,  1975)1  The  only  specific  proposal  for  quantifying  component  1  1 
I  availability  criteria  for  diesel-generator  reliability  |  | 

I  testing.  Goal  is  .99  at  nominal  50%  confidence  level.  |xl 

(Zebroski,  |  For  a  core  melt,  design  must  provide  1  in  1000  chance  |  ] 

1980)  1  of  protection.  Stabilize  above  goal  for  10  years;  be-  1  | 

I  yond  1990,  consider  higher  goals.  Recurrence  frequency  |  | 

1  of  50  years,  1  in  5000  chance  of  public  protection.  |x| 

I  1%  probability  per  failure  that  any  person  receives  |  1 

I  >5  rems .  I  I 

I  10%  probability  per  failure  that  total  population  dose  |  j 

1  >25,000  person-rems.  I 

1  Need  to  increase  resources  on  existing  domestic  energy.  ] 


NOTE:  The  parenthetical  entries  in  the  SOURCE  column  correspond  to 

similar  entries  in  the  References. 


ACRS  =  Advisory  Committee  on  Reactor  Safeguards 
AECC  =  Atomic  Energy  Commission  of  Canada 
ICRP  =  International  Committee  on  Radiological  Protection 
NRC  =  Nuclear  Regulatory  Commission 
OTA  =  Office  of  Technological  Assessment 
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Fig.  4--Quantitative  Safety  Goal  for  Public  Property  Risk 
Proposed  by  Joksimovic  (1980) 


effects.  Recall  that  this  position  is  similar  to  Maxey's  (1982). 
Similarly,  Adams  and  Stone  (1967)  propose  that  the  incremental  increase 
in  an  individual's  fatality  rate  per  year  should  be  less  than  the 
demographic  variation  in  risk  across  the  United  Kingdom. 

Kaplan,  in  interpreting  the  question,  "How  safe  is  safe  enough? 
states  that,  objectively,  the  only  risk  universally  acceptable  is  zero 
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risk,  a  condition  that  he  recognizes  as  unachievable  due  to  a  variety  of 
factors  (Kaplan,  1981). 

Others  use  cost  considerations  in  their  criteria.  However,  since 
our  general  concern  here  is  with  quantitative  criteria  based  on  human 
mortality,  we  will  not  specifically  evaluate  these  criteria  as  we  do 
those  in  Tables  1-3;  Table  4  shows  a  range  of  other  tjqjes  of  criteria 
that  have  been  proposed. 

Although  this  study  is  concerned  with  human  mortality  as  the  basis 
for  the  criteria  and  performance  measures  it  discusses,  one  cost  con¬ 
sideration  should  be  discussed:  cost-benefit  approaches  to  risk  reduc¬ 
tion.  In  general,  such  approaches  imply  trade-offs  between  the  costs  of 
safety  improvements  and  the  benefits  received.  Weighing  the  cost  of 
safety  systems  against  the  costs  saved  (in  terms  of  system  reliability 
and  availability  gains),  this  may  be  feasible  though  complex.  However, 
because  it  considers  costs  of  improvements  versus  lives  saved,  the  pro¬ 
cess  is  the  subject  of  much  debate.  Ultimately,  the  question  becomes, 
"What  is  the  dollar  value  of  a  human  life?"  In  NUREG-0739,  early  fatal¬ 
ities  are  valued  at  $5  million  per  life,  and  delayed  fatalities  at  $1 
million.  The  AIF  (1981)  uses  $1  million  per  life  saved.  Salem  et  al. 
(1980)  point  out  other  values  that  have  been  used;  for  example,  the 
National  Highway  Traffic  Safety  Administration  has  found  that  reduction 
in  highway  fatalities  has  cost  $287,175.00  per  life  saved. 

Hov7  can  cost  be  factored  into  safety  criteria?  It  is  possible  to 
ignore  it  completely.  In  our  evaluations  in  Section  III,  we  are  not 
concerned  with  whether  costs  or  other  bases  were  used  in  determining  a 
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specific  criterion,  only  whether  a  rational  basis  was  used.  In  nuclear 
reactor  safety,  one  often-cited  basis  is  the  ALARA  (  as  low  as  reason¬ 
ably  achievable")  criterion.  That  is,  additional  safety  systems  or 
improvements  should  be  incorporated  into  a  plant  as  long  as  each  can 
reduce  the  risk  by  an  additional,  cost-effective  increment.  Thus,  the 
test  of  whether  additional  systems  are  necessary  is  whether  a  lower 
level  of  risk  is  "reasonably  (i.e.,  cost  effectively)  achievable.  In 
the  case  of  nuclear  reactor  licensing,  "reasonable"  has  been  temporarily 
defined,  at  least  in  one  case,  to  avoid  argument.  This  has  been  set  at 
$1,000.00  per  person-rem  of  exposure  (Code  of  Federal  Regulations ,  10 
CFR  50,  Appendix  I).  In  very  rough  terms,  this  could  correspond  to  $10 
million  per  life  saved,  assuming  about  1  excess  fatality  per  10,000 
person-rems . 

The  merits  of  such  considerations,  however,  need  not  be  weighed 
against  those  of  alternative  criteria  that  are  based  solely  on  human 
life.  The  two  concepts  may  actually  be  combined.  For  example,  an  ALARA 
criterion  could  be  incorporated  into  a  wide  range  of  criteria,  such  as 
reduction  of  risk  to  a  level  as  low  as  reasonably  achievable  below  a 
specific  risk  level.  Thus,  even  though  a  plant  might  meet  a  certain 
required  level  of  safety,  it  would  have  to  make  further  improvements  if 
additional  risk  reduction  was  shown  to  be  cost  effectively  achievable. 
Such  action  would  also  assure  the  utilities  that  non-cost-effective 
measures  would  not  be  required  at  a  later  date. 
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III.  THE  EVALUATION 


This  section  evaluates  each  of  the  proposed  criteria  that  we  have 
tabulated.  First,  we  define  the  metric  used  to  make  the  evaluation- -the 
performance  measures.  Next,  we  caution  readers  about  the  inevitable 
shortcomings  of  such  an  evaluative  approach.  Finally,  we  apply  the  per 
formance  measures  and  evaluate  each  criterion. 

EVALUATION  BASED  ON  PERFORMANCE  MEASURES 

Some  of  the  safety  criteria  proposed  in  Section  II  have  attributes 
that  are  clearly  superior  to  others.  To  more  explicitly  rank  or  evalu¬ 
ate  the  performance  of  each  criterion,  we  must  identify  the  superior 
attributes  that  could  comprise  the  "perfect"  criterion  and  assess  how 
the  criterion  measures  up  to  those  desired  attributes. 

Those  positive  attributes  are  what  we  call  performance  measures . 

We  expect  that  the  most  useful  criteria  will  contain  most  of  those 
attributes.  The  seven  performance  measures  used  here  are  as  follows: 

1.  Does  the  criterion  comprehensively  address  all  risks,  including 
direct  and  indirect  risks,  immediate  and  delayed  effects? 
Although  no  single  criterion  addresses  all  aspects  of  direct 
and  indirect  risks,  those  that  address  more  are  rated  higher. 
Direct  risks  are  defined  as  those  risks  that  are  directly 
caused  by  the  accident.  They  include  risks  that  result  from 
exposure  to  radiation,  both  occupational  and  general  population 
exposure.  This  exposure  may  result  in  immediate  and  delayed 
effects.  Indirect  risks  result  from  the  accident;  these 
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include  risks  to  individuals  cleaning  up  after  the  accident, 
and  injuries  and  mortalities  related  to  evacuation.  They  may 
also  include  property  damage  and  loss  of  a  resource,  such  as 
agricultural  land,  lakes,  and  so  on. 

2.  Is  the  criterion  precise  and  unambiguous?  Will  all  people 
interpret  it  in  exactly  the  same  way?  The  need  for  consistent 
interpretation  is  obvious;  one  would  want  consistent  interpre¬ 
tations  over  time,  across  designs,  and  across  individuals.  The 
more  specifically  defined  the  criterion,  the  more  unambiguous 
the  interpretation. 

3.  Does  the  proposed  criterion  treat  data  and  methodological 
uncertainty,  and  if  so,  to  what  extent?  Can  the  criterion  deal 
with  undefinable  factors?  Uncertainty  plays  a  major  role  in 
the  risk  caused  by  a  technology  and  in  the  perception  of  that 
risk  by  the  general  population. 

4.  Is  the  criterion  realistic  and  practical?  If  the  proposed  cri¬ 
terion  requires  the  impossible,  its  application  may  achieve 
nothing  useful.  For  example,  criteria  are  unrealistic  if  they 
demand  zero  risk  or  if  they  set  a  specific  goal  within  too 
small  a  margin  of  uncertainty. 

5.  Is  the  criterion  defensible?  That  is,  what  is  the  rationale 
behind  the  criterion?  For  example,  an  often-quoted  criterion 
suggests  that  delayed  death  from  cancer  is  more  desirable  than 
immediate  death.  Proponents  of  this  position  claim  that 
specific  numbers  can  be  inferred,  but  they  fail  to  distinguish 
between  what  society  might  judge  as  best  for  people  as  a  whole 
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and  what  a  single  individual  might  judge  as  best  for  himself  or 
herself.  Defensible  criteria  describe  both  the  logic  used  to 
arrive  at  them  and  the  assumptions  used  to  support  them.  (For 
example,  assumptions  dealing  with  the  number  of  nuclear  reac¬ 
tors  on  line  should  be  specified.) 

6.  Is  the  criterion  simple?  Is  it  clearly  understandable?  To 
what  extent  is  the  criterion  consistent  with  intuitive  judg¬ 
ment?  Counter-intuitive  criteria  are  less  readily  implemented 
and  accepted. 

7  Is  the  criterion  internally  consistent?  A  criterion  is  inter¬ 
nally  inconsistent  in  that  it  may  specify  two  or  more  criteria 
that  do  not  reduce  to  a  common  number.  A  criterion  that  speci¬ 
fies  both  individual  and  societal  risk  without  specifying  the 
societal  population  is  an  internally  inconsistent  criterion. 

All  those  who  offer  criteria  that  appear  in  more  than  one  table 
among  Tables  1,  2,  and  3  are  inconsistent.  This  seventh  per¬ 
formance  measure  is  not  shown  in  the  tables;  instead,  it  is 
discussed  in  the  next  subsection. 

USE  OF  THE  PERFORMANCE  MEASURES 

Each  of  the  performance  measures  plays  a  role  in  deciding  which  of 
the  criteria  in  Section  II  is  likely  to  be  most  useful  in  deciding  what 
constitutes  an  appropriate  level  of  safety.  Before  applying  these  per¬ 
formance  measures  to  each  of  the  criteria,  however,  it  must  be 
emphasized  that  these  measures  are  far  from  perfect. 
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First,  the  performance  measures  are  often  interconnected.  For 
example,  two  of  the  measures  are  "simple"  and  "unambiguous.  Although 
these  measures  are  somewhat  distinct,  a  criterion  that  is  unambiguous 
would  correlate  with  one  that  would  be  simple.  Second,  the  list  of  per¬ 
formance  measures  is  necessarily  incomplete.  There  are  other  ways  of 
assessing  the  criteria,  such  as  explicit  public  acceptability.  But  such 
a  parameter  is  difficult  to  measure,  and  public  acceptability  is  implied 
in  several  performance  measures.  Third,  the  relative  importance  of  each 
measure  is  subject  to  interpretation.  (Which  is  more  important,  defensi- 
bllity  or  simplicity?)  Fourth,  the  documentation  on  each  of  the  cri¬ 
teria  differs.  Some  are  documented  extensively;  others  are  not.  And, 
finally,  both  the  evaluation  process  and  the  measures  are  highly  subjec¬ 
tive.  In  fact,  one  rather  curious  result  of  the  evaluation  process  is 
that  although  two  or  more  proposed  criteria  might  be  quantitatively 
identical,  they  may  be  qualitatively  very  different.  This  dichotomy 
comes  about  because  the  bases  used  by  proposal  makers  in  arriving  at 
their  criteria  might  be  very  different,  some  bases  being  far  superior  to 
others . 

If  they  are  all  so  difficult  to  separate  from  one  another  and  judge 
on  their  merits,  why  use  the  performance  measures?  They  allow  us  to 
distinguish  between  promising  proposals  and  ones  that  could  be  dismissed 
easily,  and  could  provide  a  basis  by  which  to  formulate  a  hybrid  cri¬ 
terion  made  up  of  the  best  features  of  each  criterion.  The  very  process 
of  examining  the  criteria  and  evaluating  their  aggregate  features  allows 
us  to  combine  and  eliminate  some  criteria. 


-38- 


THE  EVALUATION 

The  evaluation  process  is  highly  qualitative  and  subjective.  It 
places  each  criterion  and  measure  in  a  matrix  and  assigns  a  "O",  or 

rating  to  each  matrix  element.  The  grades  are  relative:  +  means 

the  criterion  meets  the  performance  measure  better  than  most  other  cri¬ 
teria  do;  "o"  suggests  that  it  may  meet  it  in  part;  and  means  that 
it  either  barely  meets  the  performance  measure  or  does  not  meet  it  at 
all.  This  qualitative  rating  scheme  distinguishes  between  practical  and 
impractical  criteria,  as  shown  in  Tables  5A,  SB,  and  5C.  Specific  exam¬ 
ples  of  ratings  for  each  of  the  first  six  performance  measures  are  given 
below. 

Table  5A  shows  the  evaluation  of  the  core-melt  criteria,  whereas 
Tables  SB  and  SC,  respectively,  illustrate  the  evaluations  of  individual 
and  societal  risk  criteria.  Entries  in  Table  SA  are  given  in  \mits  of 
core  melts  per  R-Y;  entries  in  Table  SB  in  units  of  marginal  Increase  in 
mortality  risk  per  R-Y.  Entries  in  Table  SC  are  given  in  one  of  four 
units:  LCF,  thyroid  cancers,  and  person-rems  per  R-Y  if  they  are  not 

enclosed  by  parentheses,  and  LCF  per  l.OE+10  kilowatt-hours  if  they  are 
enclosed  by  parentheses. 

When  there  is  more  than  one  criterion  from  a  single  source,  the 
ratings  for  performance  measures  1  through  6  are  often  identical. 
Exceptions  to  this  general  rule  come  about  when  the  criteria  being 
assessed  are  derived  from  different  considerations. 

However,  when  multiple  criteria  appear  across  more  than  one  table, 
the  ratings  for  performance  measure  number  7  (internally  consistent)  is 
almost  consistently  This  rating  comes  about  because  these  mul- 


-39- 


Table  5A 

EVALUATION  OF  CORE -MELT  CRITERIA 


Source 

: Criterion 

Performance  Measure* 

:  1  : 

:  2  :  3  ;  4  :  5  : 

6  : 

ACRS 

l.OE-4 

0 

+ 

0 

+ 

- 

0 

ACRS 

5.0E-4 

0 

+ 

0 

+ 

- 

0 

ACRS 

3.0E-4 

0 

+ 

0 

+ 

- 

0 

ACRS 

l.OE-3 

0 

+ 

0 

+ 

- 

0 

AIF 

l.OE-4 

0 

- 

0 

+ 

0 

0 

Burns 

5.0E-7 

0 

+ 

0 

0 

+ 

Burns 

2.5E-5 

0 

0 

- 

0 

+ 

Bhatta- 

charyya 

l.OE-6 

0 

0 

- 

- 

0 

0 

Griesmeyer 

5.0E-3 

0 

-f 

0 

+ 

- 

0 

Griesmeyer 

l.OE-3 

0 

+ 

0 

+ 

- 

0 

Mitra 

4.5E-3 

+ 

+ 

- 

+ 

0 

0 

Mitra 

5.5E-4 

+ 

+ 

+ 

+ 

0 

0 

Mitra 

2.2E-3 

+ 

+ 

- 

+ 

0 

+ 

Mitra 

1.7E-3 

+ 

+ 

- 

+ 

0 

+ 

NRC 

l.OE-4 

0 

- 

- 

+ 

0 

0 

0 ' Donne 1 

3.0E-4 

0 

0 

- 

0 

0 

0 

Vesely 

l.OE-3 

0 

0 

0 

- 

0 

0 

Vesely 

1.0E-4< 

l.OE-3 

0 

0 

+ 

“ 

0 

Vesely 

l.OE-5 

0 

0 

0 

0 

0 

- 

Vesely 

1.0E-6< 

l.OE-5 

0 

0 

+ 

0 

Wall 

l.OE-5 

0 

0 

0 

0 

0 

Wall 

l.OE-4 

0 

+ 

0 

+ 

0 

0 

Zebroski 

5.0E-4 

0 

0 

0 

+ 

0 

0 

Zebroski 

3.3E-4 

0 

0 

+ 

+ 

0 

0 

Zebroski 

3.  lE-4 

0 

0 

+ 

0 

0 

Zebroski 

2.9E-4 

0 

0 

+ 

+ 

0 

0 

Zebroski 

2.5E-4 

0 

0 

+ 

-1- 

0 

0 

Zebroski 

2.3E-4 

0 

0 

+ 

+ 

0 

0 

Zebroski 

2.1E-4 

0 

0 

4- 

+ 

0 

0 

Zebroski 

5.0E-7 

0 

0 

+ 

+ 

0 

0 

■"NOTE;  The  performance  measures  used  in  this  table  may  be 

identified  as  follows:  1)  comprehensive;  2)  unambiguous 
3)  uncertainty  treated;  4)  practicable;  5)  defensible; 

6)  simple;  7)  internally  consistent  (not  shown  in  table) 
ACRS  =  Advisory  Committee  on  Reactor  Safeguards 
AIF  =  Atomic  Industrial  Forum 
NRC  =  Nuclear  Regulatory  Commission 
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Table  5B 

EVALUATION  OF  INDIVIDUAL  RISK  CRITERIA 


Source  : Criterion  :  Performance  Measure* 


1  : 

2  : 

3  : 

4  : 

5  : 

6  : 

ACRS 

5.0E-6 

+ 

0 

0 

+ 

0 

0 

ACRS 

2.5E-5 

•f 

0 

0 

■f 

0 

0 

ACRS 

l.OE-6 

+ 

0 

0 

+ 

0 

0 

ACRS 

5.0E-6 

+ 

0 

0 

+ 

0 

0 

AdamsSStone 

l.OE-5 

0 

- 

0 

+ 

0 

+ 

AIF 

l.OE-5 

+ 

0 

0 

+ 

0 

0 

Atchison 

l.OE-6 

0 

0 

0 

+ 

0 

0 

Bowen 

l.OE-5 

4* 

- 

0 

+ 

0 

0 

Burns 

l.OE-7 

0 

- 

0 

- 

0 

0 

ICRP 

l.OE-4 

0 

0 

0 

0 

0 

0 

ICRP 

l.OE-5 

0 

0 

0 

+ 

0 

0 

Inter-Org. 

l.OE-6 

0 

+ 

0 

+ 

0 

0 

Joksimovic 

l.OE-4 

+ 

0 

0 

- 

0 

0 

Kinchin 

l.OE-6 

0 

0 

•f 

- 

0 

Kinchin 

3.0E-5 

+ 

0 

0 

+ 

“ 

0 

Maxey 

2.0E-5 

0 

+ 

- 

+ 

0 

+ 

Mitra 

l.OE-6 

+ 

- 

+ 

+ 

0 

0 

Mitra 

l.OE-5 

+ 

- 

+ 

+ 

0 

0 

NRC 

l.OE-3 

+ 

0 

0 

0 

0 

0 

Starr 

l.OE-8 

+ 

0 

0 

- 

0 

+ 

Starr 

l.OE-4 

+ 

0 

0 

0 

+ 

Wall 

l.OE-8 

0 

- 

0 

- 

0 

0 

■■'•NOTE;  The  performance  measures  used  in  this  table  may  be 

identified  as  follows:  1)  comprehensive;  2)  unambiguous; 
3)  uncertainty  treated;  4)  practicable;  5)  defensible; 

6 )  s imp 1 e . 

ACRS  =  Advisory  Committee  on  Reactor  Safeguards 
AIF  =  Atomic  Industrial  Forum 
ICRP  =  International  Committee  on  Radiological  Protection 
Inter-Org.  =  Inter-Organizational  Working  Group 
NRC  =  Nuclear  Regulatory  Commission 
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Table  5C 

EVALUATION  OF  SOCIETAL  RISK  CRITERIA 


Source  : Criterion 


Performance  Measure* 


1 

2  : 

3 

4 

5 

6  : 

ACRS 

(2) 

+ 

0 

+ 

0 

0 

+  : 

ACRS 

(10) 

+ 

0 

+ 

0 

0 

+  : 

ACRS 

(0.4) 

+ 

0 

+ 

0 

0 

+  : 

ACRS 

(2) 

+ 

0 

+ 

0 

0 

+  : 

AIF 

. 1/GWe  yr . 

0 

- 

- 

0 

- 

0  : 

Atchison 

3667  rems 

0 

0 

0 

0 

0 

0  : 

Atchison 

1.2E-2  LCF 

0 

0 

0 

0 

0 

0  : 

Atchison 

0.0018-0.011 

0 

0 

+ 

0 

0 

0  : 

Atchison 

.00025-. 0015 

0 

0 

+ 

0 

0 

0  : 

Burns 

0.10  LCF 

0 

0 

0 

0 

0 

0  : 

Burns 

500  rems 

0 

0 

0 

0 

0 

0  : 

Burns 

750  rems 

0 

0 

+ 

0 

0 

0  : 

Burns 

1500  rems 

0 

0 

+ 

0 

0 

0  : 

Joks imovic 

100 

0 

0 

- 

0 

0 

-  : 

Kinchin 

+ 

+ 

+ 

0 

+ 

0  : 

Levine 

0 

+ 

0 

- 

+ 

0  : 

NRC 

2 

0 

0 

0 

0 

0 

0  : 

Wall 

500  rems 

0 

0 

0 

0 

0 

0  : 

Wall 

0.05  LCF 

0 

0 

0 

0 

0 

0  : 

Zebroski 

25,000  rems 

0 

0 

0 

0 

0 

0  : 

■'NOTE:  The  performance  measures  used  in  this  table  may  be 


identified  as  follows:  1)  comprehensive;  2)  unambiguous 
3)  uncertainty  treated;  4)  practicable;  5)  defensible; 

6)  simple. 

ACRS  =  Advisory  Committee  on  Reactor  Safeguards 
AIF  =  Atomic  Industrial  Forum 
NRC  =  Nuclear  Regulatory  Commission 
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tiple  criteria  are  generally  derived  from  different  assumptions  and  are 
based  on  different  rationales.  Although  multiple  criteria  offered  in 
any  one  table  often  have  a  consistent  basis,  multiple  criteria  offered 
in  different  tables  consistently  have  diverse  bases.  For  example,  each 
person  offering  an  individual  risk  criterion  in  Table  5B  and  also  offer¬ 
ing  a  societal  risk  criterion  in  Table  5C  never  identifies  his  assump¬ 
tions  on  population  distribution  or  meteorological  conditions,  both  of 
which  affect  the  number  of  mortalities.  Therefore,  information  in  Table 
5C  is  not  directly  derivable  from  that  given  in  Table  5B.  Because  mul¬ 
tiple  criteria  across  different  tables  always  earn  a  negative  rating,  we 
do  not  indicate  that  finding  in  the  tables. 

No  Proposal  Considers  All  Aspects  of  Societal  Risk  (Comprehensiveness) 
Societal  risks  have  many  facets,  ranging  from  direct  risks  to 
indirect  risks.  Direct  risks  are  those  that  result  from  direct  exposure 
to  radioactivity.  Such  risks  may  cause  either  immediate  or  delayed 
effects,  and  include  risks  to  individuals  exposed  to  average  doses  of 
radiation  and  to  individuals  exposed  to  the  maximum  doses.  Individuals 
include  members  of  the  general  population  and  the  occupational  work 
force.  Indirect  risks  develop  as  a  direct  result  of  the  accident  and 
include  the  risks  associated  with  evacuation  (such  as  traffic  mortali¬ 
ties),  with  accident  cleanup  (such  as  increased  exposure  to  radiation), 
and  with  the  resulting  financial  loss  (property  damage,  accident  cleanup 
costs,  loss  of  generating  capacity,  decreased  industrial  growth,  and  so 
on)  . 
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Because  no  single  proposal  considers  more  than  a  few  of  these 
risks,  a  proposal  need  only  consider  a  few  to  earn  a  "+"  rating.  Propo¬ 
sals  that  consider  one  or  perhaps  two  risks  generally  earn  a  "O."  A  few 
proposals  earn  a  if  they  consider  only  immediate  mortality  to  an 

individual  exposed  to  an  average  dose. 

Several  proposals  earn  a  "+."  The  Mitra  et  al.  (1981)  core-melt 
criteria  earn  a  "+"  because  they  collectively  consider  core  melt  and 
dollar  loss  and  relate  their  criteria  to  the  accidents  at  Brown's  Ferry 
and  Three  Mile  Island,  thereby,  presumably,  considering  both  direct  and 
indirect  risks.  The  ACRS  (NUREG-0739)  proposal  earns  a  "+"  on  societal 
and  individual  mortality-risk  criteria  for  considering  both  early  and 
delayed  mortality.  AIF  (Inside  NRG ,  1980a),  Bowen  (1975),  Joksimovic 
(1980),  Kinchin  (1979),  NRG  (Inside  NRG,  1981a),  and  Starr  (1981)  each 
earn  a  "+"  for  individual  mortality  risk  because  they  specified  both 
delayed  and  early  criteria.  Kinchin's  (1979)  societal  risk  curves  earn 
a  "+"  for  considering  both  early  and  delayed  effects.  Maxey  (1982) 
earns  a  "O"  grade.  Although  she  fails  to  explicitly  state  the  extent  to 
which  her  proposal  covers  direct  and  indirect  risks ,  it  would  not  be 
difficult  to  extend  her  quite  straightforward  criterion  to  consider  a 
broader  range  of  risks . 

Most  Proposals  Are  Explicit  (Unambiguous) 

For  a  proposal  to  be  considered  unambiguous,  it  must  have  a  clearly 
stated  rationale  for  nuclear  power  growth  estimates,  which  includes: 

1)  how  many  years  an  initial  set  of  values  should  be  used  on  an  interim 
basis;  2)  if  the  criterion  would  be  interpreted  precisely  the  same  way 
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by  each  person,  for  each  design;  and  3)  if  the  criterion  clearly  defines 
the  problem. 

Most  of  the  proposals  receive  "O"  or  "+"  for  this  performance  mea¬ 
sure;  a  few  receive  Proposals  that  received  a  "O"  or  grade 

often  did  so  because  they  imprecisely  defined  such  critical  terms  as 
"core  melt,"  "large-scale,"  and  "accident." 

For  individual  risk  criteria,  Maxey  earns  the  highest  "+"  because 
of  the  directness  of  her  criterion. 

The  evaluations  made  under  this  performance  measure  are  particu¬ 
larly  sensitive  to  the  quality  of  information  available  on  each  cri¬ 
terion.  Not  all  criteria  are  described  at  the  same  level  of  detail. 
Further,  not  all  criteria  in  the  tables  are  as  up-to-date  as  one  would 
wish,  nor  as  precise  as  the  author  may  have  meant  them  to  be. 

Few  Criteria  Completely  Accommodate  Data  Uncertainty  (Uncertainty  Treated) 

The  rule  of  thumb  used  in  grading  the  proposals  is  to  give  a  "+"  if 
the  proposal  addresses  uncertainty  by  considering  some  sort  of  confi¬ 
dence  bands.  A  "O"  rating  is  given  if  uncertainty  is  recognized  but  not 
treated  adequately.  Otherwise,  a  rating  of  "-"  is  given. 

The  proposals  that  consider  uncertainty  do  so  in  various  ways.  In 
one  proposal,  Vesely  provides  a  warning  range  which  stipulates  that  it 
would  be  up  to  NRC ' s  review  whether  or  not  the  plant  should  be  shut 
down.  The  warning  range  accounts  for  uncertainties  in  the  calculation 
inherent  in  estimating  the  frequency  of  core-damage  accidents.  In 
another  proposal,  Vesely  does  not  provide  a  warning  range.  Where  he 
suggests  a  warning  range,  his  criterion  gets  a  "+" ;  otherwise  it  gets  a 
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"O."  Burns  proposes  an  alternate  in  case  his  recommended  criterion  can¬ 
not  be  met.  Because  that  does  not  fully  address  the  question  of  uncer¬ 
tainty,  it  earns  a  "O."  Starr  provides  an  upper  limit  four  orders  of 
magnitude  greater  than  his  individual  risk  criterion,  which  also  earns  a 
"O."  Mitra  et  al .  (1981)  give  an  additional  individual  risk  criterion 
as  a  numerical  parameter  with  a  95  percent  confidence  level.  This  cri¬ 
terion  earns  a  "+." 

Many  Criteria  Are  Practicable  (Practicable) 

The  test  for  practicability  is  simple.  A  proposal  receives  a  "+" 
grade  if  several  of  the  following  conditions  are  met: 

1.  Time  test:  If  the  criterion  has  been  applied  implicitly  to  the 
nuclear  industry  sometime  before,  it  would  be  considered  a  de 
facto  criterion  that  is  "acceptable."  This  condition  applies, 
for  example,  to  core-melt  criteria,  as  well  as  to  the  $1,000 
per  person-rem  interim  cost -benefit  criterion  of  the  NRC  Rules 
and  Regulations  (Appendix  I  of  the  Code  of  Federal  Regulations , 
Part  50). 

2.  Relates  to  other  industry:  Is  the  criterion  based  on  an  adap¬ 
tation  of  what  might  already  have  been  time-tested  in  another 
industry?  If  so,  we  may  be  better  able  to  determine  whether 
the  criterion  is  transferable  to  the  nuclear  power  industry. 
However,  as  Salem  et  al.  (1980)  explain,  the  extent  to  which 
criteria  are  transferable  across  industries,  especially  the 


nuclear  industry,  is  uncertain. 
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3.  Sufficiently  lenient:  Criteria  would  not  be  considered  practi¬ 
cable  if  they  were  so  stringent  that  new  reactor  designs  that 
use  the  best  and  most  current  safety  systems  would  be  unable  to 
meet  them.  However,  older  reactors  might  be  exempted  from  such 
newer  criteria;  for  example,  NUREG-0739  applies  to  new  reactors 
only. 

4.  Too  lenient:  Criteria  that  are  too  lenient  would  be  inherently 
unacceptable  by  the  NRC . 

Even  when  set  against  these  four  conditions,  most  criteria  earn  a 
"+"  grade.  Maxey  (1982)  again  earns  a  very  high  "+"  because  of  the 
time-tested  nature  of  her  criterion.  A  few  outliers  earn  a  grade 
for  being  too  lenient  or  too  stringent.  (Such  definitions  of  lenient 
and  stringent  are,  of  course,  highly  subjective.) 

No  Criterion  Can  Always  Be  Defensible 

Criteria  that  are  defensible  are  criteria  that  are  formed  on  some 
rational  basis.  For  example,  they  must  detail  their  evolution,  be 
developed  from  some  accepted  or  acknowledged  standard,  and  consist  of 
detailed,  highly  supportable  assumptions.  For  purposes  of  ranking, 
unsupportable  assumptions  would  be  considered  the  same  as  no  basis  at 
all. 

Many  criteria  earn  a  "O"  because  they  are  only  moderately  defensi¬ 
ble,  providing  only  some  limited  basis  for  the  rationale  behind  the  cri¬ 
terion.  Adams  and  Stone  (1967)  contend  that  the  risk  is  acceptable  if 
the  risk  from  nuclear  plants  falls  below  that  of  the  natural  demographic 
variation  in  the  United  Kingdom  (U.K.).  No  numerical  parameter  was 


-47- 


presented,  however.  Maxey  earns  a  "O"  for  a  similar  reason.  Mitra  et 
al.  (1981)  limit  their  bases  to  past  operating  experience  in  the  nuclear 
industry;  no  theoretical  basis  is  given. 

The  criteria  tend  to  be  more  a  matter  of  judgment  than  scientifi¬ 
cally  backed  findings.  For  instance.  Kinchin's  rationale  for  his  early 
death-limit  curve  was:  "it  would  not  seem  unreasonable  to  propose  a 
criterion  that  the  total  risk  from  nuclear  reactors  should  be  roughly 
comparable  with  that  from  meteorites."  Each  of  an  assumed  population  of 
100  reactors  in  the  U.K.  was  assigned  1/100  of  the  total  risk.  The 
societal  delayed-death  curve  was  formed  using  the  same  factor  of  30  used 
to  set  the  limit  on  individual  delayed-death  risk  (Kinchin,  1979). 

Levine  (1981)  discussed  the  rationale  behind  each  of  several  propo¬ 
sals  that  we  have  evaluated  here.  He  summarized  the  rationale  used  to 
develop  the  three  factors  that  we  have  discussed:  core  melt,  individual 
risks,  and  societal  risks.  We  have  condensed  the  rationales  for  several 
of  these  proposals  into  tabular  form;  they  are  presented  in  Table  6.  We 
have  not  used  this  table  as  a  separate  means  of  augmenting  the  rankings 
presented  in  Table  5.  Rather,  we  compared  each  individual  rationale  to 
that  given  in  the  original  source  for  each  criterion,  and  used  the  com¬ 
bined  information  to  arrive  at  the  rankings  in  Table  5.  Notice  that 
several  of  Levine's  own  criteria  are  not  presented  in  Tables  1-5.  These 
were  not  included  in  our  original  sampling  of  criteria  (in  this  case, 
Levine,  1980),  and  we  have  not  yet  attempted  to  evaluate  any  criteria 
published  after  mid-1981. 
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Table  6 

RATIONALE  FOR  FORMULATING  PROPOSALS  FOR  THE  CRITERIA 


PROPOSAL 

FACTOR  : 

CORE  MELT 

INDIVIDUAL  RISK  : 

SOCIETAL  RISK  : 

(NUREG-0739) 

Keep  frequency 

<  TMI-2  or 

<  1  per  100  R-Y 

Smaller  than 
background 

No  basis  on 
delayed  death 

Delayed  death  : 
based  on  coal  : 
plants  : 

Early  deaths .  : 
20%  of  delayed  : 

(AIF,  1981) 

NA  (not  appli¬ 
cable) 

Smaller  than 
background 

Comparable  to  : 
other  energy  : 
production  : 

(Joksimovic, 

1980) 

NA 

Uses  both  EPA 
rules  &  Appendix 
I  of  10  CFR  50 

Small  increase  : 
over  background. : 
Cancer  following: 
an  accident  : 

(Starr,  1981) 

NA 

For  people  far 
from  plant .  Same 
as  background 

NA  : 

For  people  near 
plant,  100  times 
greater  risk 

(Levine , 

1981) 

A  factor  of  50. 
More  lenient 
than  WASH- 1400 

Factor  of  1/30 
of  equivalent 
early  fatalities. 
Based  on  worker 
preference  data 

Curve  is  0 . 1%  : 
of  sum  of  all  : 
man-made  acci-  : 
dents  : 

May  raise  this  : 
by  factor  of  10  ; 

(Kinchin, 

1979) 

NA 

; Early  deaths 
: based  on  ICRP 

rFactor  of  30  less 
:  stringent  for 
: delayed  deaths. 

; Based  on 
: intuition 

Early  deaths. 

Based  on  meteorite 
impact  probability 
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Table  6  (cont.) 


PROPOSAL 

FACTOR 

CORE  MELT 

INDIVIDUAL  RISK 

SOCIETAL  RISK 

(Bhattach- 

aryya, 

1981) 

Uses  maximum 
equivalent 
hazard  state 

No  distinction 
between  delayed 
and  early  deaths 

Expected  values 
to  maximum  exposed 
individuals 

Small  compared 
to  background 

No  weighting  for 
large  consequence 

Small  population 
around  sites 

(NUREG-0739) 

No  basis  given 

Small  compared 
to  background 

Consistent  with 
risk  from  coal 

(WASH- 1400) 

Varied 

Varied 

Varied 

NOTE:  The  parenthetical  entries  in  the  PROPOSAL  column 
correspond  to  similar  entries  in  the  References. 


An  Overly  Simplified  Criterion  May  Lack  Credence  (Simple) 

Although  simplicity  can  be  thought  of  as  a  positive  attribute, 
simplistic  criteria  often  are  indefensible,  do  not  account  properly  for 
uncertainty,  and  are  ambiguous.  Simple  criteria  are  unconditional  and 
do  not  depend  on  many  factors,  but  are  readily  understood  by  most  of 
those  who  use  them.  Adams  and  Stone  (1967)  simply  relate  acceptable 
incremental  risk  to  demographic  variations,  which  can  be  measured  and 
used  as  a  guideline.  This  earns  a  "+"  for  simplicity.  Burns  (1979) 
allows  for  a  5  percent  chance  of  core  melt  in  100,000  reactor  years.  On 
the  positive  side,  the  numbers  are  simple,  easy  to  understand,  and  com- 
monsensical.  On  the  negative  side.  Burns'  criteria  do  not  deal  ade- 
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quately  with  vincertainty .  Burns  earns  a  "+"  for  simplicity  and  a  "o" 
for  dealing  with  uncertainty. 

It  is  clear  that  criteria  which  are  comprehensive,  defensible,  and 
treat  uncertainty  will  almost  certainly  be  more  complex  than  those  which 
do  not.  Therefore,  our  ranking  of  the  simplicity  of  any  criterion  is 
somewhat  subjective--a  criterion  that  meets  most  other  performance  meas¬ 
ures  is  expected  to  be  less  simple  and  need  not  earn  a  just  because 
it  is  detailed.  The  details  themselves  must  be  clearly  stated.  Thus,  a 
complex  but  precisely  detailed  criterion  would  be  considered  simpler 
than  a  short  but  unintelligible  or  poorly  defined  one. 

Internally  Inconsistent  Criteria 

A  criterion  can  have  no  internal  consistency  if  it  is  presented  in 
more  than  one  table.  How  we  judge  this  internal  inconsistency  is  quite 
simple.  We  look  at  the  criterion  offered  for,  say,  core  melt  and  from 
that  derive  the  individual  risk  criterion  and  the  societal  risk  cri¬ 
terion.  Because  assumed  population  distributions  and  meteorology  condi¬ 
tions  were  not  given,  the  numbers  that  we  derived  did  not  match  what  was 
offered  by  others. 

SUMMARY 

Although  these  evaluations  reveal  numerous  findings  specific  to  a 
variety  of  criteria,  they  identify  three  trends  generic  to  most  or  all 
criteria: 

1.  Little  consensus  exists  on  a  universal  risk  criterion.  That 
lack  of  consensus  underscores  the  highly  subjective  nature  of 
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the  criteria  selection  process,  a  process  that  may  not  yield 
one  single,  universally  accepted  criterion. 

2.  No  single  criterion  is  both  simple  to  understand  and  easy  to 
implement.  Further,  no  apparent  mechanism  for  implementation 
is  generally  offered. 

3.  None  of  the  criteria  can  adequately  accommodate  uncertainty  in 
the  data.  Although  uncertainty  must  be  bounded,  it  is  inherent 
in  any  complex  system  and  cannot  be  eliminated.  Uncertainty 
must  be  treated  systematically. 

Under  what  conditions  are  these  proposals  most  applicable?  Before 
answering  that  question,  the  five  shortcomings  discussed  earlier  must  be 
overcome:  1)  the  performance  measures  are  not  concretely  definable;  2) 

they  do  not  encompass  the  entire  range  of  valuation  measures;  3)  the 
relative  importance  of  one  measure  compared  to  another  is  subject  to 
value  judgment;  4)  each  criterion  is  differently  documented  and  under¬ 
stood;  and  the  5)  evaluation  process  is  highly  subjective.  Were  it  not 
for  those  five  shortcomings,  the  criteria  might  be  ranked  in  descending 
order  by  identifying  as  best  those  criteria  awarded  the  most  "+"es  and 
the  least  "-"es.  Thus,  Maxey,  the  ACRS,  or  Mitra  might  be  the  winners. 

In  view  of  the  shortcomings,  however,  there  are  only  three  things 
we  can  do:  1)  ignore  the  evaluation;  2)  permit  the  evaluator  to  substi¬ 
tute  his  or  her  own  performance  measures  and  weights;  or  3)  attempt  to 
develop  a  hybrid  criterion  or  set  of  criteria  made  up  of  the  best 
features  of  each  proposal.  The  first  alternative  requires  no  action, 
the  second  requires  action  only  by  the  interested  reader.  The  third 
requires  the  kind  of  assessment  we  discuss  in  the  section  that  follows. 
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IV.  CAN  WE  DEFINE  AN  OPTIMAL  RISK  CRITERION? 


This  section  is  divided  into  four  subsections.  First,  we  address 
the  question  of  whether  we  can  define  an  optimal  criterion.  Second,  we 
qualitatively  describe  the  features  of  the  hybrid  we  recommend.  Third, 
we  quantify  that  hybrid.  And  fourth,  we  present  a  rationale  for  that 
hybrid. 

CAN  WE  DEFINE  AN  OPTIMAL  CRITERION? 

The  answer  to  that  question  is,  simply,  no.  Our  evaluation  merely 
segregates  each  of  the  criterion  into  three  rating  groups,  ranking  them 
in  relation  to  one  another.  At  best,  this  approach  assures  only  that  we 
can  separate  the  better  criteria  (based  on  a  set  of  performance  mea¬ 
sures)  from  all  others;  it  in  no  way  implies  that  we  can  discover  the 
best  criterion  (if  one  is,  theoretically,  even  possible). 

In  applying  the  performance  measures  to  each  of  the  proposed  cri¬ 
teria,  we  found  that  no  single  criterion  received  a  "+"  grade  on  all 
measures.  In  fact,  only  a  few  criteria  earned  three  or  four  out  of  six 
"+"  grades,  and  only  the  core-melt  criteria  of  Mitra  et  al.  (1981) 
received  five  out  of  six  "+"  grades.  We  speak  of  only  six  performance 
measures  because  the  seventh  measure,  internal  consistency,  always  leads 
to  for  multiple  criteria. 

Based  on  this  finding,  can  we  arrive  at  a  hybrid  criterion  or  set 
of  criteria  that  incorporates  the  best  features  of  each  of  the  proposed 
criteria?  If  so,  this  hybrid  criterion's  features  would  resemble 
closely  the  specifications  outlined  for  each  performance  measure  and  as 
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such  would  have  the  same  shortcomings.  With  regard  to  each  performance 
measure,  this  hybrid  would  have  a  number  of  specific  qualitative 
features . 

THE  HYBRID  CRITERION:  A  QUALITATIVE  DESCRIPTION 

The  hybrid  criterion  would  comprehensively  address  societal  risk. 

It  would  be  concerned  with  both  immediate  and  delayed  mortality  and 
would  consider  not  only  the  individual  exposed  to  an  average  level  of 
risk,  but  also  those  exposed  to  higher  levels.  This  hybrid  criterion 
might  also  address  the  issue  of  secondary  effects  from  the  risk.  (Such 
risks  as  those  that  might  result  from  evacuation,  accident  cleanup,  and 
job  relocations  would  be  considered  valid  secondary  risks.)  One  could 
successfully  argue  that  more  people  might  die  as  a  result  of  traffic 
accidents  while  evacuating  from  the  site  of  a  nuclear  accident  than 
would  die  as  a  direct  result  of  the  accident  for  less  than  catastrophic 
core  melts .  Although  each  of  these  secondary  risks  might  complicate  the 
criterion,  a  criterion  that  specifies  a  common  denominator  of  equivalent 
early  and  equivalent  delayed  mortalities  from  all  causes  would  more 
equitably  reflect  the  total  risk  and  would  be  judged  more  sound. 

Of  the  proposed  criteria,  only  those  of  Mitra  et  al.  (1981)  par¬ 
tially  consider  secondary  costs;  several  individuals  consider  delayed 
mortality,  and  only  a  few  consider  the  people  most  exposed.  Specifi¬ 
cally,  Mitra  et  al.  (1981)  address  the  problem  of  replacement  power 
costs  but  fail  to  consider  secondary  mortalities.  The  ACRS  (NUREG- 
0739),  Griesmeyer  et  al.  (1979),  Kinchin  (1979),  Bowen  (1979),  and 
several  others  distinguish  between  delayed  and  immediate  mortality. 
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This  hybrid  would  be  both  simple  and  unambiguous.  A  simple  cri¬ 
terion  might  be  described  as  one  that  is  intuitive  or  commons ensical  and 
does  not  depend  on  many  complicating  conditions.  However,  an  unambigu¬ 
ous  criterion  might  be  described  as  one  that  explicitly  states  each 
assumption  and  condition  upon  which  it  is  based.  Few  criteria  are  both 
explicit  and  simple.  The  two  criteria  of  Mitra  et  al.  dealing  with  core 
damage  and  replacement  power  costs  following  a  core  melt  are  both  explic¬ 
it  and  simple. 

This  hybrid  would  account  for  uncertainty  in  the  data  base  and  the 
PRA  methodology.  Vesely,  Starr  and  Whipple,  Mitra  et  al . ,  Zebroski,  the 
ACRS,  Atchison,  and  Joksimovic  each  accommodate  for  uncertainty  in 
either  PRA  methodology,  data  base,  or  both.  Vesely  provides  warning 
ranges j  Starr  and  Whipple  provide  an  upper  limit  four  orders  of  magni¬ 
tude  greater  than  his  mean;  and  Mitra  et  al.  specify  a  95  percent  confi¬ 
dence  limit.  Zebroski 's  core-melt  criteria  reflect  differing  assump¬ 
tions  about  reactor  years  assumed  to  be  operating  over  the  next  twenty 
years.  The  ACRS  bounds  their  individual  mortality  risk  criteria  by  set¬ 
ting  an  upper  limit  and  a  goal  level.  Atchison  specifies  a  range  for 
latent  thyroid  fatalities.  None  of  the  other  proposals  accommodates  for 
uncertainty  to  such  an  extent. 

This  hybrid  would  be  practicable.  Many  of  the  proposed  criteria 
are  practicable;  that  is  to  say,  they  either  do  not  ask  for  the  impossi¬ 
ble  or  they  have  been  used  before. 

The  hybrid  would  be  defensible.  The  more  defensible  criteria  are 
based  on  some  rationale  that  uses  past  experience  either  within  the 
nuclear  industry  or  in  another  industry  with  accident  scenarios  of  siml- 
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lar  potential.  The  more  defensible  criteria  clearly  specify  each  of 
their  assumptions.  For  core-melt  criteria,  Mitra  et  al.  base  their  two 
proposals  on  relevant  past  experience. 

Levine  (1981)  outlines  each  factor  judged  important  in  setting 
safety  goals.  His  factors  very  clearly  complement  and  support  the  qual¬ 
itative  description  of  the  hybrid  criterion  that  we  have  just  outlined, 
and,  as  such,  are  summarized  below.  We  endorse  each  of  his  ten  points. 

1.  The  goals  should  have  three  purposes:  to  help  ensure  adequate 
protection  of  the  public;  to  help  make  the  regulatory  process 
more  rational;  and  to  be  easily  understood  by  a  broad  spectrum 
of  society. 

2.  The  criteria  should  be  used  expressly  as  goals,  not  as  regula¬ 
tory  requirements  specifically  applied  to  individual  reactor¬ 
licensing  cases. 

3.  The  goal  should  be  such  that  it  does  not  contribute  signifi¬ 
cantly  to  the  sum  of  existing  risk.  Also,  comparisons  between 
safety  goals  and  other  risks  must  be  made  on  the  basis  of  more 
than  just  average  risk. 

4.  A  high  degree  of  specificity  should  be  avoided. 

5 .  Early  and  latent  fatalities  should  be  combined  so  that  future 
mortalities  are  not  discounted. 

6.  Individual  and  societal  risks  and  core-melt  probabilities 
should  be  stated  explicitly. 

7.  Engineering  factors  are  of  secondary  importance  compared  to 
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8.  Engineering  factors  with  high  calculational  uncertainty  should 
be  avoided. 

9.  Cost-benefit  criterion  in  dollars  per  person-rem  should  be 
included. 

10.  Nuclear  risks  should  not  be  disproportionately  weighted  in 
relation  to  other  risks. 

THE  HYBRID  CRITERION:  A  QUANTITATIVE  DESCRIPTION 

Quantitatively,  what  should  this  hybrid  criterion  look  like?  We 
would  require  some  level  of  certainty  on  calculated  data.  This  level  of 
certainty  ought  to  be  less  than  100  percent.  We  cannot  determine  its 
precise  value  at  this  time.  Mitra  et  al.  suggest  a  95  percent  level  of 
certainty;  we  have  no  reason  to  dispute  this  number. 

We  suggest  the  following  quantitative  values.  For  the  probability 
of  core  melt  per  R-Y,  this  hybrid  might  range  between  l.OE-3  and  l.OE-4. 
For  marginal  increase  in  an  individual's  annual  mortality  rate,  it  might 
range  between  2.0E-5  and  l.OE-6  per  R-Y.  For  societal  risk  measured  in 
person-rems,  the  range  might  be  between  1000  and  10,000  per  R-Y  through 
about  the  year  2000.  At  that  time,  and  depending  on  the  size  of  the 
nuclear  power  industry,  this  number  would  have  to  be  reevaluated. 

THE  BASIS  FOR  OUR  HYBRID  CRITERION 

To  determine  that  basis,  we  must  first  ask  two  pragmatic  questions: 
How  did  we  arrive  at  the  quantitative  values?  How  did  we  arrive  at  the 
qualitative  description? 

The  basis  for  our  quantitative  range  is  simple  and  highly  subjec¬ 
tive.  We  consider  those  criteria  that  earn  the  most  "+"es  and  least 
"-"es,  group  them,  and  specify  the  range  in  values  that  this  group  covers. 
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Outliers  are  discarded  if  the  range  is  much  beyond  a  certain  order  of 
magnitude.  The  basis  for  our  qualitative  criteria  is  far  more  complex 
to  describe.  Point  by  point,  we  here  describe  that  basis. 

Why  Address  Societal  Risks  Comprehensively? 

We  believe  that  all  components  of  a  risk,  including  direct  and 
indirect  risks  and  immediate  and  delayed  risks,  are  necessary  for  decid¬ 
ing  between  alternative  criteria.  A  primary  purpose  of  establishing  a 
criterion  is  to  assist  in  deciding  which  of  several  viable  alternatives 
is  the  least  risky.  Because  each  alternative  brings  with  it  both  direct 
and  immediate  risks  as  well  as  indirect  and  delayed  risks,  we  contend 
that  any  sound  decision  must  include  those  factors. 

Do  Not  Discount  Future  Risks  Too  Heavily 

We  judge  that  the  rate  at  which  future  risks  are  discounted  is  an 
important  element  of  any  acceptable  risk  criterion. 

Although  identifying  a  proper  discount  rate  is  far  beyond  the  scope 
if  our  work,  we  can  identify  a  simple  ground  rule  for  selecting  this 
factor:  it  should  account  for  all  future  risks,  especially  risk  cri¬ 

teria  for  waste  disposal.  This  argues  for  a  small  discount  rate  or  a 
modest  rate  for  near-term  risks  and  a  zero  or  near-zero  rate  beyond  a 
couple  of  generations. 

Although  we  are  unwilling  to  offer  what  we  think  is  a  reasonable 
factor  for  discounting  future  risks,  we  dispute  the  larger  factors,  for 
three  reasons.  First,  they  tend  to  be  inconsistent.  Second,  the 
discount  factor  seems  so  high  that  risks  more  than  a  couple  of  genera- 
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tions  into  the  future  are  not  likely  to  be  counted.  Third,  the  discount 
factors  that  were  offered  do  not  appear  to  be  based  on  any  sound  reasoning. 

Why  Use  Simple  Criteria? 

The  more  conditional  the  criterion,  the  more  subject  it  would  be  to 
ambiguous  interpretation.  Highly  conditional  criteria  might  offer  more 
opportunity  for  equitable  standards,  but  to  those  who  need  to  interpret 
and  enforce  these  criteria,  they  present  more  subjective  information. 

Include  Uncertainty 

Any  valid  criterion  must  recognize  the  potential  for  uncertainty 
that  must  be  considered  when  compounding  calculations  needed  to  fulfill 
any  PRA.  The  mechanism  for  including  uncertainty  would  consist  of  iden¬ 
tifying  a  range  rather  than  a  single  criterion.  This  range  would 
require  that  some  band  of  confidence  be  met,  suggesting  that  all  future 
PRA  calculations  carry  with  them  a  standard  for  propagating  uncertainty. 

Criteria  requiring  repeated  calculations  that  would  accumulate 
uncertainty  must  be  avoided.  Wide  uncertainty  bands  would  tend  to 
dilute  the  issues  rather  than  reinforce  the  criterion. 

Select  a  Proven  Criterion 

Criteria  that  have  been  proven  or  time-tested  are  generally  more 
appealing  than  those  that  are  merely  deduced.  When  both  time-tested  and 
simple,  a  criterion  like  Maxey's  (risk  should  be  equal  to  the  variance 
in  background  radiation  level  across  the  country)  is  quite  attractive. 
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Maxey's  inferred  value  of  2.0E-5  fatality  rate  per  R-Y  reflects  the 
least  restrictive  bound  of  our  hybrid  criterion. 

Avoid  Risk  Aversion 

We  argue  against  including  risk  aversion  as  part  of  the  hybrid  cri¬ 
terion.  If  all  direct  and  indirect  components  of  the  risk  are  con¬ 
sidered,  then  including  some  risk  aversion  for  nuclear  power  is  unjusti¬ 
fiable.  That  is  to  say,  by  properly  accounting  for  all  indirect  risks 
of  nuclear  power  and  by  selecting  a  rational  discount  factor  for  future 
risks,  including  some  additional  risk  aversion  factor  is  double  counting. 

Human  Health  is  of  Primary  Importance 

The  hybrid  should  be  primarily  concerned  with  maintaining  human 
health  and  secondarily  concerned  with  engineering  considerations  and 
property  damage.  This  reasoning  argues  for  placing  a  high  value  on 
human  life  and  making  some  cost/benefit  decisions  in  meeting  design 
standards  that  ensure  that  this  concern  will  be  an  integral  part  of  any 


potential  safety  criterion. 
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